Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-3505 (GCVE-0-2026-3505)
Vulnerability from cvelistv5 – Published: 2026-04-15 09:06 – Updated: 2026-09-09 12:04
VLAI
EPSS
VEX
Title
Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
Summary
Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).
This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.
This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 13:10 UTC
CWE
Assigner
References
23 references
Impacted products
42 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Legion of the Bouncy Castle Inc. | BC-JAVA |
Affected:
1.74 , < 1.80.2
(maven)
Affected: 1.81 , < 1.81.1 (maven) Affected: 1.82 , < 1.84 (maven) |
guessed | |
| Red Hat | Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 |
cpe:/a:redhat:apache_camel_quarkus:3.27
|
||
| Red Hat | Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 |
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.25 |
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.16.0-22.redhat_00057.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.3.14-11.SP11_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:1.5.26-2.Final_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.18.8-1.redhat_00003.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:5.0.31-3.SP2_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:1.10.0-46.Final_redhat_00044.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:4.1.135-1.Final_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.5.5-30.SP12_redhat_00020.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.5.5-24.SP12_redhat_00016.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.2.40-2.SP3_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:7.4.25-2.GA_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 |
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 |
Unaffected:
0:1.84.0-1.redhat_00001.1.el8eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 |
Unaffected:
0:1.84.0-1.redhat_00001.1.el9eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.12 |
Unaffected:
1786628667 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.12::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.13 |
Unaffected:
1786628681 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.13::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.14 |
Unaffected:
1786533561 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.14::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.15 |
Unaffected:
1786533565 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.15::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.16 |
Unaffected:
1787125166 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.16::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.17 |
Unaffected:
1787124635 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.17::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.18 |
Unaffected:
1787125069 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.18::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.19 |
Unaffected:
1787124632 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.19::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.20 |
Unaffected:
1787124925 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.20::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.21 |
Unaffected:
1787125311 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.21::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.22 |
Unaffected:
1787124779 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.22::el9 |
||
| Red Hat | OpenShift Developer Tools and Services |
cpe:/a:redhat:ocp_tools
|
||
| Red Hat | Red Hat AMQ Clients |
cpe:/a:redhat:amq_clients:2023
|
||
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 |
cpe:/a:redhat:camel_quarkus:3
|
||
| Red Hat | Red Hat Data Grid 8 |
cpe:/a:redhat:jboss_data_grid:8
|
||
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
||
| Red Hat | Red Hat Fuse 7 |
cpe:/a:redhat:jboss_fuse:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 |
cpe:/a:redhat:jboss_enterprise_application_platform:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp
|
||
| Red Hat | Red Hat Process Automation 7 |
cpe:/a:redhat:jboss_enterprise_bpms_platform:7
|
||
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
||
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
||
| Red Hat | streams for Apache Kafka 2 |
cpe:/a:redhat:amq_streams:2
|
||
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3505",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T13:10:48.791999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T13:10:55.206Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_quarkus:3.27"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk18on",
"product": "Red Hat Build of Apache Camel 4.14 for Quarkus 3.27",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk18on",
"product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
],
"defaultStatus": "unaffected",
"product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-activemq-artemis",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.16.0-22.redhat_00057.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-glassfish-jsf",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-ironjacamar",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-annotations",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-core",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-databind",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-jaxrs-providers",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-base",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-java8",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-remoting",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-server-migration",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty-transport-native-epoll",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-bindings",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-federation",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-undertow",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-wildfly",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk15on",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
],
"defaultStatus": "affected",
"packageName": "eap8-bouncycastle",
"product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.84.0-1.redhat_00001.1.el8eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "affected",
"packageName": "eap8-bouncycastle",
"product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.84.0-1.redhat_00001.1.el9eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786628667",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.13::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786628681",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.14::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533561",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.15::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533565",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125166",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.17::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124635",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125069",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124632",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124925",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125311",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124779",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "jenkins",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "jenkins-2-plugins",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_clients:2023"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk18on",
"product": "Red Hat AMQ Clients",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "affected",
"packageName": "bcpg-jdk18on",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk15on",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk18on",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "jmc",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcpg-jdk15on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcpg-jdk18on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "affected",
"packageName": "bcpg-jdk15on",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-fips",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk15on",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk18on-1.83.0.redhat-00001.jar",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "bcpg-jdk15on",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite:el8/candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "bcpg-jdk15on",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk18on",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "unaffected",
"packageName": "bcpg-jdk18on",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-15T09:06:37.939Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T12:04:46.295Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"name": "RHBZ#2458638",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3505.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18054"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18055"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13631"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
},
{
"lang": "en",
"value": "RHSA-2026:18054: Red Hat JBoss EAP 8.1 for RHEL 8"
},
{
"lang": "en",
"value": "RHSA-2026:18055: Red Hat JBoss EAP 8.1 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:60247: OpenShift Developer Tools and Services 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:60249: OpenShift Developer Tools and Services 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:60248: OpenShift Developer Tools and Services 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:60239: OpenShift Developer Tools and Services 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:60251: OpenShift Developer Tools and Services 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:60246: OpenShift Developer Tools and Services 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:60250: OpenShift Developer Tools and Services 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:60252: OpenShift Developer Tools and Services 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:60259: OpenShift Developer Tools and Services 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:60254: OpenShift Developer Tools and Services 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:60256: OpenShift Developer Tools and Services 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:13631: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27"
},
{
"lang": "en",
"value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
},
{
"lang": "en",
"value": "RHSA-2026:18059: Red Hat JBoss Enterprise Application Platform 8.1"
},
{
"lang": "en",
"value": "RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-15T10:01:17.415Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-15T09:06:37.939Z",
"value": "Made public."
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
"defaultStatus": "unaffected",
"modules": [
"pg"
],
"packageName": "bcpg",
"platforms": [
"all"
],
"product": "BC-JAVA",
"programFiles": [
"AEADEncDataPacket.java",
"BcAEADUtil.java",
"JceAEADUtil.java",
"OperatorHelper.java"
],
"repo": "https://github.com/bcgit/bc-java",
"vendor": "Legion of the Bouncy Castle Inc.",
"versions": [
{
"lessThan": "1.80.2",
"status": "affected",
"version": "1.74",
"versionType": "maven"
},
{
"lessThan": "1.81.1",
"status": "affected",
"version": "1.81",
"versionType": "maven"
},
{
"lessThan": "1.84",
"status": "affected",
"version": "1.82",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Disclosure \u003cdisclosure@aisle.com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).\u003cp\u003e This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\u003c/p\u003e\u003cp\u003eThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\u003c/p\u003e"
}
],
"value": "Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).\n\n This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T23:21:21.526Z",
"orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
"shortName": "bcorg"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
},
{
"tags": [
"patch"
],
"url": "https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
"assignerShortName": "bcorg",
"cveId": "CVE-2026-3505",
"datePublished": "2026-04-15T09:06:37.939Z",
"dateReserved": "2026-03-04T00:44:50.028Z",
"dateUpdated": "2026-09-09T12:04:46.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-3505",
"date": "2026-09-09",
"epss": "0.00787",
"percentile": "0.53993"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-3505\",\"sourceIdentifier\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"published\":\"2026-04-15T10:16:49.133\",\"lastModified\":\"2026-09-09T13:19:49.180\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).\\n\\n This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\\n\\n\\n\\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\"}],\"affected\":[{\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"affectedData\":[{\"vendor\":\"Legion of the Bouncy Castle Inc.\",\"product\":\"BC-JAVA\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://www.bouncycastle.org/download/bouncy-castle-java/\",\"packageName\":\"bcpg\",\"modules\":[\"pg\"],\"platforms\":[\"all\"],\"programFiles\":[\"AEADEncDataPacket.java\",\"BcAEADUtil.java\",\"JceAEADUtil.java\",\"OperatorHelper.java\"],\"repo\":\"https://github.com/bcgit/bc-java\",\"versions\":[{\"version\":\"1.74\",\"lessThan\":\"1.80.2\",\"versionType\":\"maven\",\"status\":\"affected\"},{\"version\":\"1.81\",\"lessThan\":\"1.81.1\",\"versionType\":\"maven\",\"status\":\"affected\"},{\"version\":\"1.82\",\"lessThan\":\"1.84\",\"versionType\":\"maven\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Apache Camel 4.14 for Quarkus 3.27\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on\",\"cpes\":[\"cpe:/a:redhat:apache_camel_quarkus:3.27\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4.25\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-activemq-artemis\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.16.0-22.redhat_00057.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-glassfish-jsf\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.3.14-11.SP11_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-ironjacamar\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:1.5.26-2.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-annotations\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-core\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-databind\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-jaxrs-providers\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-modules-base\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-modules-java8\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jboss-remoting\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:5.0.31-3.SP2_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jboss-server-migration\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:1.10.0-46.Final_redhat_00044.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-netty\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:4.1.135-1.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-netty-transport-native-epoll\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:4.1.135-1.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-picketlink-bindings\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.5.5-30.SP12_redhat_00020.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-picketlink-federation\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.5.5-24.SP12_redhat_00016.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-undertow\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.2.40-2.SP3_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-wildfly\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:7.4.25-2.GA_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap8-bouncycastle\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8\"],\"versions\":[{\"version\":\"0:1.84.0-1.redhat_00001.1.el8eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap8-bouncycastle\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"],\"versions\":[{\"version\":\"0:1.84.0-1.redhat_00001.1.el9eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.12::el8\"],\"versions\":[{\"version\":\"1786628667\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.13::el8\"],\"versions\":[{\"version\":\"1786628681\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.14::el8\"],\"versions\":[{\"version\":\"1786533561\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.15::el8\"],\"versions\":[{\"version\":\"1786533565\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.16::el9\"],\"versions\":[{\"version\":\"1787125166\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.17::el9\"],\"versions\":[{\"version\":\"1787124635\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.18::el9\"],\"versions\":[{\"version\":\"1787125069\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.19::el9\"],\"versions\":[{\"version\":\"1787124632\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.20\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.20::el9\"],\"versions\":[{\"version\":\"1787124925\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.21\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.21::el9\"],\"versions\":[{\"version\":\"1787125311\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.22::el9\"],\"versions\":[{\"version\":\"1787124779\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jenkins\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jenkins-2-plugins\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Clients\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_clients:2023\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4 for Quarkus 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on\",\"cpes\":[\"cpe:/a:redhat:camel_quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jmc\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-fips\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on-1.83.0.redhat-00001.jar\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"candlepin\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite:el8/candlepin\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk15on\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcpg-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-15T13:10:48.791999Z\",\"id\":\"CVE-2026-3505\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"},{\"lang\":\"en\",\"value\":\"CWE-770\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1\",\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\"},{\"url\":\"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505\",\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13631\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17668\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18054\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18055\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18059\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53644\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53806\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60239\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60246\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60247\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60248\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60249\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60250\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60251\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60252\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60254\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60256\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60259\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-3505\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2458638\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3505.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-09-08T22:59:06+00:00",
"cve": "CVE-2026-3505",
"id": "CVE-2026-3505",
"initial_release_date": "2026-04-15T09:06:37.939000+00:00",
"product_status:fixed": "157",
"product_status:known_affected": "10",
"product_status:known_not_affected": "258",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3505.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:apache_camel_quarkus:3.27\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Apache Camel 4.14 for Quarkus 3.27\", \"packageName\": \"bcpg-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\", \"packageName\": \"bcpg-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4.25\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.16.0-22.redhat_00057.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-activemq-artemis\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.3.14-11.SP11_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-glassfish-jsf\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.5.26-2.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-ironjacamar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-annotations\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-databind\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-jaxrs-providers\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-modules-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-modules-java8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:5.0.31-3.SP2_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jboss-remoting\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.10.0-46.Final_redhat_00044.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jboss-server-migration\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.1.135-1.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.1.135-1.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-netty-transport-native-epoll\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.5-30.SP12_redhat_00020.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-picketlink-bindings\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.5-24.SP12_redhat_00016.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-picketlink-federation\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.2.40-2.SP3_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-undertow\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:7.4.25-2.GA_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-wildfly\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcpg-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcpg-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.84.0-1.redhat_00001.1.el8eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap8-bouncycastle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.84.0-1.redhat_00001.1.el9eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap8-bouncycastle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786628667\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.13::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.13\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786628681\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.14::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533561\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533565\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125166\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.17\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124635\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125069\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124632\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.20\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124925\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.21\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125311\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124779\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"jenkins\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"jenkins-2-plugins\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_clients:2023\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Clients\", \"packageName\": \"bcpg-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4 for Quarkus 3\", \"packageName\": \"bcpg-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"bcpg-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"bcpg-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"jmc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcpg-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcpg-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"bcpg-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"bcpg-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcpg-fips\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcpg-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcpg-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcpg-jdk18on-1.83.0.redhat-00001.jar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"bcpg-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"candlepin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite:el8/candlepin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"bcpg-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 2\", \"packageName\": \"bcpg-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"bcpg-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-15T10:01:17.415Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-15T09:06:37.939Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18054: Red Hat JBoss EAP 8.1 for RHEL 8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18055: Red Hat JBoss EAP 8.1 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60247: OpenShift Developer Tools and Services 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60249: OpenShift Developer Tools and Services 4.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60248: OpenShift Developer Tools and Services 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60239: OpenShift Developer Tools and Services 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60251: OpenShift Developer Tools and Services 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60246: OpenShift Developer Tools and Services 4.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60250: OpenShift Developer Tools and Services 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60252: OpenShift Developer Tools and Services 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60259: OpenShift Developer Tools and Services 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60254: OpenShift Developer Tools and Services 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60256: OpenShift Developer Tools and Services 4.22\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13631: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18059: Red Hat JBoss Enterprise Application Platform 8.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-15T09:06:37.939Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-3505\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2458638\", \"name\": \"RHBZ#2458638\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3505.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53644\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18054\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18055\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60247\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60249\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60248\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60239\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60251\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60246\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60250\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60252\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60259\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60254\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60256\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13631\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53806\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18059\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17668\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-09-07T12:04:57.440Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-3505\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-15T13:10:48.791999Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-15T13:10:51.998Z\"}}], \"cna\": {\"title\": \"Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Disclosure \u003cdisclosure@aisle.com\u003e\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/bcgit/bc-java\", \"vendor\": \"Legion of the Bouncy Castle Inc.\", \"modules\": [\"pg\"], \"product\": \"BC-JAVA\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.74\", \"lessThan\": \"1.80.2\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"1.81\", \"lessThan\": \"1.81.1\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"1.82\", \"lessThan\": \"1.84\", \"versionType\": \"maven\"}], \"platforms\": [\"all\"], \"packageName\": \"bcpg\", \"programFiles\": [\"AEADEncDataPacket.java\", \"BcAEADUtil.java\", \"JceAEADUtil.java\", \"OperatorHelper.java\"], \"collectionURL\": \"https://www.bouncycastle.org/download/bouncy-castle-java/\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).\\n\\n This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\\n\\n\\n\\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).\u003cp\u003e This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\u003c/p\u003e\u003cp\u003eThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of resources without limits or throttling\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"91579145-5d7b-4cc5-b925-a0262ff19630\", \"shortName\": \"bcorg\", \"dateUpdated\": \"2026-05-18T23:21:21.526Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-3505\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-07T12:04:57.440Z\", \"dateReserved\": \"2026-03-04T00:44:50.028Z\", \"assignerOrgId\": \"91579145-5d7b-4cc5-b925-a0262ff19630\", \"datePublished\": \"2026-04-15T09:06:37.939Z\", \"assignerShortName\": \"bcorg\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:18059
Vulnerability from csaf_redhat - Published: 2026-05-18 12:12 - Updated: 2026-09-09 16:06Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update
Severity
Important
Notes
Topic: A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.6 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.5, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.6 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* bcpg-fips: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
* bcpkix-fips: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
* bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598)
* netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871)
* netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values (CVE-2026-33870)
* artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication (CVE-2026-27446)
* org.hibernate.orm/hibernate-c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects (CVE-2026-27830)
* org.keycloak-keycloak-parent: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
* mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects (CVE-2026-27727)
* io.hawt-project: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
* wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI (CVE-2025-23368)
* plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy to gain unauthorized access to sensitive cryptographic information.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. The primary consequence is the potential for message injection into any queue and/or message exfiltration from any queue via the rogue broker.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted `javax.naming.Reference` or serialized object to an application using the library. This can provoke the application to download and execute arbitrary malicious code due to mchange-commons-java's independent implementation of Java Naming and Directory Interface (JNDI) dereferencing, which supports remote code loading. This could lead to arbitrary code execution within the affected application.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in c3p0, a Java Database Connectivity (JDBC) Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or `javax.naming.Reference` instances. By manipulating the `userOverridesAsString` property, an attacker can cause the application to download and execute malicious code from a remote location on its CLASSPATH.
8.0 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server's lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
References
103 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.6 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.5, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.6 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* bcpg-fips: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)\n\n* bcpkix-fips: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)\n\n* bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n\n* bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n\n* bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598)\n\n* netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871)\n\n* netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values (CVE-2026-33870)\n\n* artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication (CVE-2026-27446)\n\n* org.hibernate.orm/hibernate-c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects (CVE-2026-27830)\n\n* org.keycloak-keycloak-parent: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects (CVE-2026-27727)\n\n* io.hawt-project: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI (CVE-2025-23368)\n\n* plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:18059",
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/7137769",
"url": "https://access.redhat.com/articles/7137769"
},
{
"category": "external",
"summary": "2337621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337621"
},
{
"category": "external",
"summary": "2441268",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
},
{
"category": "external",
"summary": "2442671",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442671"
},
{
"category": "external",
"summary": "2442908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442908"
},
{
"category": "external",
"summary": "2442922",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
},
{
"category": "external",
"summary": "2444320",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444320"
},
{
"category": "external",
"summary": "2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "2452453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
},
{
"category": "external",
"summary": "2452456",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452456"
},
{
"category": "external",
"summary": "2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "2458635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458635"
},
{
"category": "external",
"summary": "2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18059.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update",
"tracking": {
"current_release_date": "2026-09-09T16:06:27+00:00",
"generator": {
"date": "2026-09-09T16:06:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:18059",
"initial_release_date": "2026-05-18T12:12:14+00:00",
"revision_history": [
{
"date": "2026-05-18T12:12:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-18T11:17:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-09T16:06:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 8.1",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 8.1",
"product_id": "Red Hat JBoss Enterprise Application Platform 8.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"acknowledgments": [
{
"names": [
"Claudia Bartolini",
"Marco Ventura",
"Massimiliano Brolli"
],
"organization": "TIM S.p.A"
}
],
"cve": "CVE-2025-23368",
"cwe": {
"id": "CWE-307",
"name": "Improper Restriction of Excessive Authentication Attempts"
},
"discovery_date": "2025-01-14T14:56:46.792000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2337621"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.wildfly.core:wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "According to WildFly Elytron, this affects all versions of JBoss EAP from version 7.1.\nRed Hat build of Keycloak does not ship wildfly-elytron.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-23368"
},
{
"category": "external",
"summary": "RHBZ#2337621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337621"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-23368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-23368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23368"
},
{
"category": "external",
"summary": "https://www.gruppotim.it/it/footer/red-team.html",
"url": "https://www.gruppotim.it/it/footer/red-team.html"
}
],
"release_date": "2025-03-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "workaround",
"details": "The effectiveness of an attack will also be dependent on the complexity of the usernames and passwords defined for the target installation.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.wildfly.core:wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-5598",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2026-04-15T10:01:04.531185+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458635"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy to gain unauthorized access to sensitive cryptographic information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an unauthenticated attacker needs to send highly specific, malformed ciphertexts to the target server. These payloads are used to interact with the private key of the server in a way that the vulnerable, non-constant time code paths are triggered during the verification step. An attack typically requires sending a large volume of these requests to perform statistical analysis on the resulting timing variations, increasing its complexity.\nThe primary security impact of this vulnerability is the potential leakage of private keys associated with the FrodoKEM implementation. This can compromise encrypted communications or authentication mechanisms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5598"
},
{
"category": "external",
"summary": "RHBZ#2458635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458635"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5598"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998"
}
],
"release_date": "2026-04-15T09:05:56.277000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement aggressive rate limiting and anomaly detection, specifically looking for unusual, high-frequency cryptographic handshake failures or anomalous traffic patterns targeting endpoints that handle key exchanges in the network logs.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons"
},
{
"cve": "CVE-2026-26996",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-02-20T04:01:11.896063+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2441268"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-26996"
},
{
"category": "external",
"summary": "RHBZ#2441268",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
"url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
"url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
}
],
"release_date": "2026-02-20T03:05:21.105000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
},
{
"cve": "CVE-2026-27446",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-03-04T07:02:26.064000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444320"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. The primary consequence is the potential for message injection into any queue and/or message exfiltration from any queue via the rogue broker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as IMPORTANT severity because it does not enable remote code execution or system compromise (arbitrary code execution), which is Red Hat\u0027s threshold for Critical impact. Its impact is limited to message injection and exfiltration via rogue broker federation. Exploitation requires the broker to accept inbound Core protocol connections from untrusted networks with outbound connectivity to attacker-controlled systems. Availability impact is set to None as exploitation does not cause service disruption or broker instability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27446"
},
{
"category": "external",
"summary": "RHBZ#2444320",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444320"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27446"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27446",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27446"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg",
"url": "https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg"
}
],
"release_date": "2026-03-04T06:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict Core protocol support on acceptors receiving connections from untrusted sources. The default \"artemis\" acceptor on port 61616 supports all protocols, including Core. Modify the acceptor URL to explicitly exclude the Core protocol using the \"protocols\" URL parameter. Alternatively, configure two-way SSL with certificate-based authentication to prevent unauthenticated exploitation. A service restart or reload may be required for changes to take effect.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication"
},
{
"cve": "CVE-2026-27727",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-02-25T17:04:31.254239+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2442671"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted `javax.naming.Reference` or serialized object to an application using the library. This can provoke the application to download and execute arbitrary malicious code due to mchange-commons-java\u0027s independent implementation of Java Naming and Directory Interface (JNDI) dereferencing, which supports remote code loading. This could lead to arbitrary code execution within the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27727"
},
{
"category": "external",
"summary": "RHBZ#2442671",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442671"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27727",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27727"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27727",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27727"
},
{
"category": "external",
"summary": "https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44",
"url": "https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44"
},
{
"category": "external",
"summary": "https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal",
"url": "https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal"
},
{
"category": "external",
"summary": "https://www.mchange.com/projects/c3p0/#configuring_security",
"url": "https://www.mchange.com/projects/c3p0/#configuring_security"
},
{
"category": "external",
"summary": "https://www.mchange.com/projects/c3p0/#security-note",
"url": "https://www.mchange.com/projects/c3p0/#security-note"
}
],
"release_date": "2026-02-25T16:01:04.187000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects"
},
{
"cve": "CVE-2026-27830",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-02-26T01:01:56.834884+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2442908"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in c3p0, a Java Database Connectivity (JDBC) Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or `javax.naming.Reference` instances. By manipulating the `userOverridesAsString` property, an attacker can cause the application to download and execute malicious code from a remote location on its CLASSPATH.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27830"
},
{
"category": "external",
"summary": "RHBZ#2442908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442908"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27830"
},
{
"category": "external",
"summary": "https://github.com/swaldman/c3p0/commit/e14cbd8166e423e2e9a9d6f08b2add3433492d6e",
"url": "https://github.com/swaldman/c3p0/commit/e14cbd8166e423e2e9a9d6f08b2add3433492d6e"
},
{
"category": "external",
"summary": "https://github.com/swaldman/c3p0/security/advisories/GHSA-5476-xc4j-rqcv",
"url": "https://github.com/swaldman/c3p0/security/advisories/GHSA-5476-xc4j-rqcv"
},
{
"category": "external",
"summary": "https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal",
"url": "https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal"
},
{
"category": "external",
"summary": "https://www.mchange.com/projects/c3p0/#configuring_security",
"url": "https://www.mchange.com/projects/c3p0/#configuring_security"
},
{
"category": "external",
"summary": "https://www.mchange.com/projects/c3p0/#security-note",
"url": "https://www.mchange.com/projects/c3p0/#security-note"
}
],
"release_date": "2026-02-26T00:45:18.222000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects"
},
{
"cve": "CVE-2026-27904",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-02-26T02:01:23.004531+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2442922"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27904"
},
{
"category": "external",
"summary": "RHBZ#2442922",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
"url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
}
],
"release_date": "2026-02-26T01:07:42.693000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
},
{
"cve": "CVE-2026-33870",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-03-27T21:01:59.865839+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452453"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33870"
},
{
"category": "external",
"summary": "RHBZ#2452453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8",
"url": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8"
},
{
"category": "external",
"summary": "https://w4ke.info/2025/06/18/funky-chunks.html",
"url": "https://w4ke.info/2025/06/18/funky-chunks.html"
},
{
"category": "external",
"summary": "https://w4ke.info/2025/10/29/funky-chunks-2.html",
"url": "https://w4ke.info/2025/10/29/funky-chunks-2.html"
},
{
"category": "external",
"summary": "https://www.rfc-editor.org/rfc/rfc9110",
"url": "https://www.rfc-editor.org/rfc/rfc9110"
}
],
"release_date": "2026-03-27T19:54:15.586000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values"
},
{
"cve": "CVE-2026-33871",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-03-27T21:02:13.396015+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452456"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server\u0027s lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This important vulnerability in Netty HTTP/2 servers allows a remote attacker to cause a Denial of Service by sending a flood of CONTINUATION frames. This can lead to excessive CPU consumption and render the server unresponsive. Red Hat products utilizing affected Netty versions, such as Red Hat AMQ, Enterprise Application Platform, and OpenShift Container Platform components, are impacted if configured to use HTTP/2.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33871"
},
{
"category": "external",
"summary": "RHBZ#2452456",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452456"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv"
}
],
"release_date": "2026-03-27T19:55:23.135000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-18T12:12:14+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood"
}
]
}
RHSA-2026:53644
Vulnerability from csaf_redhat - Published: 2026-08-11 16:39 - Updated: 2026-09-09 16:06Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate
Severity
Important
Notes
Topic: A security update is now available for Red Hat JBoss Enterprise Application
Platform 7.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated
this update as having a security impact of Important. A Common Vulnerability
Scoring System (CVSS) base score, which gives a detailed severity rating, is
available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.25 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.24, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.25 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* netty-codec-redis: Netty: Denial of Service via malicious Redis array header (CVE-2026-50011)
* netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
* netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays (CVE-2026-44250)
* netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads (CVE-2026-44890)
* netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (CVE-2026-46340)
* netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)
* netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)
* netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (CVE-2026-48006)
* netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
* netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)
* netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043)
* netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893)
* netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing (CVE-2026-42585)
* netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* netty-codec-http: Netty: HTTP request smuggling via URI manipulation and CRLF injection (CVE-2026-41417)
* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)
* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)
* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584)
* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)
* picketlink-federation: auth bypass in Picketlink SAML unsolicited-response (CVE-2026-10579)
* bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcprov-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcprov-jdk15: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcprov-jdk12: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcpg-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
* bcpg-jdk15on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
* bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
* bcpkix-jdk15on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
* bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-jdk15: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-jdk12: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-jdk15: private key leakage via non-constant time comparisons (CVE-2026-5598)
* bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598)
* artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication (CVE-2026-27446)
* undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery (CVE-2026-15554)
* wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller (CVE-2026-15555)
* picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions (CVE-2026-15556)
* openjdk-orb: unauthed class loading via IIOP in EAP (CVE-2026-15560)
* undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow (CVE-2026-15561)
* jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service (CVE-2026-15562)
* wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS (CVE-2026-15563)
* jsf-impl: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include (CVE-2026-46581)
* netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
* jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy to gain unauthorized access to sensitive cryptographic information.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
9.8 (Critical)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Critical
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.
7.4 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
8.8 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.
8.1 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
8.1 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
7.4 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. The primary consequence is the potential for message injection into any queue and/or message exfiltration from any queue via the rogue broker.
9.1 (Critical)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. A remote attacker can bypass request-line validation by manipulating the URI after a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created. This vulnerability, a form of Carriage Return Line Feed (CRLF) injection, allows for the insertion of additional HTTP or RTSP requests. The primary consequence is HTTP request smuggling or desynchronization, which can lead to unauthorized access or manipulation of web traffic.
6.5 (Medium)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. Netty's DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.2 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.
7.3 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate web traffic.
6.5 (Medium)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.
8.1 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending specially crafted Redis payloads across multiple connections without proper termination. This can exhaust the server's direct memory pool, leading to a Denial of Service (DoS) condition where legitimate connections cannot be processed.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses, which could enable an attacker to redirect network traffic or intercept sensitive data from affected applications.
8.7 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol (SCTP) message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service (DoS) condition. The affected component fails to limit the size or number of these fragments, allowing an attacker to consume excessive system resources.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user.
8.1 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty's `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.
8.7 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the shared memory pool. Over time, this can exhaust the available memory, causing a Denial of Service (DoS) for all Netty channels in the process.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. The RedisArrayAggregator component pre-allocates memory based on the declared element count in a Redis array header. A remote attacker can exploit this by sending a small, malicious Redis array header that claims a huge initial capacity, leading to excessive memory pre-allocation. This can result in a denial of service (DoS) due to resource exhaustion.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.
8.8 (High)
Affected products
Fixed
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
229 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A security update is now available for Red Hat JBoss Enterprise Application\nPlatform 7.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated\nthis update as having a security impact of Important. A Common Vulnerability\nScoring System (CVSS) base score, which gives a detailed severity rating, is\navailable for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.25 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.24, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.25 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* netty-codec-redis: Netty: Denial of Service via malicious Redis array header (CVE-2026-50011)\n\n* netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)\n\n* netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays (CVE-2026-44250)\n\n* netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads (CVE-2026-44890)\n\n* netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (CVE-2026-46340)\n\n* netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)\n\n* netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)\n\n* netty-codec-redis: Netty\u0027s Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (CVE-2026-48006)\n\n* netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)\n\n* netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)\n\n* netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043)\n\n* netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893)\n\n* netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing (CVE-2026-42585)\n\n* netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)\n\n* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)\n\n* netty-codec-http: Netty: HTTP request smuggling via URI manipulation and CRLF injection (CVE-2026-41417)\n\n* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)\n\n* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)\n\n* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584)\n\n* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)\n\n* picketlink-federation: auth bypass in Picketlink SAML unsolicited-response (CVE-2026-10579)\n\n* bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n\n* bcprov-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n\n* bcprov-jdk15: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n\n* bcprov-jdk12: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n\n* bcpg-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)\n\n* bcpg-jdk15on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)\n\n* bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)\n\n* bcpkix-jdk15on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)\n\n* bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n\n* bcprov-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n\n* bcprov-jdk15: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n\n* bcprov-jdk12: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n\n* bcprov-jdk15: private key leakage via non-constant time comparisons (CVE-2026-5598)\n\n* bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598)\n\n* artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication (CVE-2026-27446)\n\n* undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery (CVE-2026-15554)\n\n* wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller (CVE-2026-15555)\n\n* picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions (CVE-2026-15556)\n\n* openjdk-orb: unauthed class loading via IIOP in EAP (CVE-2026-15560)\n\n* undertow-core: OOM via missing limits in chunked trailer in EAP\u0027s Undertow (CVE-2026-15561)\n\n* jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service (CVE-2026-15562)\n\n* wildfly-iiop-openjdk: Missing authentication on EAP\u0027s IIOP NameService leads to MITM or DoS (CVE-2026-15563)\n\n* jsf-impl: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include (CVE-2026-46581)\n\n* netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)\n\n* jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s)\nlisted in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:53644",
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index"
},
{
"category": "external",
"summary": "2444320",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444320"
},
{
"category": "external",
"summary": "2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "2458635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458635"
},
{
"category": "external",
"summary": "2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "2467540",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467540"
},
{
"category": "external",
"summary": "2477217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
},
{
"category": "external",
"summary": "2477220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"category": "external",
"summary": "2477224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
},
{
"category": "external",
"summary": "2477226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
},
{
"category": "external",
"summary": "2477227",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477227"
},
{
"category": "external",
"summary": "2477232",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
},
{
"category": "external",
"summary": "2477930",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477930"
},
{
"category": "external",
"summary": "2480325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480325"
},
{
"category": "external",
"summary": "2480601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480601"
},
{
"category": "external",
"summary": "2480637",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480637"
},
{
"category": "external",
"summary": "2482963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482963"
},
{
"category": "external",
"summary": "2482965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482965"
},
{
"category": "external",
"summary": "2483121",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483121"
},
{
"category": "external",
"summary": "2483131",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483131"
},
{
"category": "external",
"summary": "2483133",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483133"
},
{
"category": "external",
"summary": "2483135",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483135"
},
{
"category": "external",
"summary": "2483136",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483136"
},
{
"category": "external",
"summary": "2483138",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483138"
},
{
"category": "external",
"summary": "2488053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488053"
},
{
"category": "external",
"summary": "2488062",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488062"
},
{
"category": "external",
"summary": "2488081",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
},
{
"category": "external",
"summary": "2488383",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488383"
},
{
"category": "external",
"summary": "2488388",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488388"
},
{
"category": "external",
"summary": "2488391",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
},
{
"category": "external",
"summary": "2488400",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488400"
},
{
"category": "external",
"summary": "2488413",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488413"
},
{
"category": "external",
"summary": "2488429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
},
{
"category": "external",
"summary": "2488433",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488433"
},
{
"category": "external",
"summary": "2488437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488437"
},
{
"category": "external",
"summary": "2488439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488439"
},
{
"category": "external",
"summary": "2488442",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488442"
},
{
"category": "external",
"summary": "2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "JBEAP-33515",
"url": "https://issues.redhat.com/browse/JBEAP-33515"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53644.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate",
"tracking": {
"current_release_date": "2026-09-09T16:06:44+00:00",
"generator": {
"date": "2026-09-09T16:06:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:53644",
"initial_release_date": "2026-08-11T16:39:22+00:00",
"revision_history": [
{
"date": "2026-08-11T16:39:22+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-11T16:39:22+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-09T16:06:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product": {
"name": "Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"product_id": "eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.26-2.Final_redhat_00001.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"product": {
"name": "eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"product_id": "eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-bindings@2.5.5-30.SP12_redhat_00020.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"product_id": "eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-remoting@5.0.31-3.SP2_redhat_00001.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"product": {
"name": "eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"product_id": "eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-46.Final_redhat_00044.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"product": {
"name": "eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"product_id": "eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-federation@2.5.5-24.SP12_redhat_00016.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"product_id": "eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-undertow@2.2.40-2.SP3_redhat_00001.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product": {
"name": "eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_id": "eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-databind@2.18.8-1.redhat_00003.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"product_id": "eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll@4.1.135-1.Final_redhat_00001.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product": {
"name": "eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_id": "eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-modules-java8@2.18.8-1.redhat_00003.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product": {
"name": "eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_id": "eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-annotations@2.18.8-1.redhat_00003.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"product": {
"name": "eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"product_id": "eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis@2.16.0-22.redhat_00057.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product": {
"name": "eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_id": "eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-modules-base@2.18.8-1.redhat_00003.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"product_id": "eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-glassfish-jsf@2.3.14-11.SP11_redhat_00001.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"product_id": "eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty@4.1.135-1.Final_redhat_00001.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product": {
"name": "eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_id": "eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-core@2.18.8-1.redhat_00003.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product": {
"name": "eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_id": "eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-providers@2.18.8-1.redhat_00003.1.el7eap?arch=src"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"product": {
"name": "eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"product_id": "eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly@7.4.25-2.GA_redhat_00001.1.el7eap?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.26-2.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-ironjacamar-common-api@1.5.26-2.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-ironjacamar-common-impl@1.5.26-2.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-ironjacamar-common-spi@1.5.26-2.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-ironjacamar-core-api@1.5.26-2.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-ironjacamar-core-impl@1.5.26-2.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-ironjacamar-deployers-common@1.5.26-2.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-ironjacamar-jdbc@1.5.26-2.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-ironjacamar-validator@1.5.26-2.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"product": {
"name": "eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"product_id": "eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-bindings@2.5.5-30.SP12_redhat_00020.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"product": {
"name": "eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"product_id": "eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-wildfly8@2.5.5-30.SP12_redhat_00020.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-remoting@5.0.31-3.SP2_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-46.Final_redhat_00044.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-cli@1.10.0-46.Final_redhat_00044.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"product": {
"name": "eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"product_id": "eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jboss-server-migration-core@1.10.0-46.Final_redhat_00044.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product": {
"name": "eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_id": "eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-api@2.5.5-24.SP12_redhat_00016.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product": {
"name": "eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_id": "eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-common@2.5.5-24.SP12_redhat_00016.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product": {
"name": "eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_id": "eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-config@2.5.5-24.SP12_redhat_00016.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product": {
"name": "eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_id": "eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-federation@2.5.5-24.SP12_redhat_00016.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product": {
"name": "eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_id": "eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-idm-api@2.5.5-24.SP12_redhat_00016.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product": {
"name": "eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_id": "eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-idm-impl@2.5.5-24.SP12_redhat_00016.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product": {
"name": "eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_id": "eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-idm-simple-schema@2.5.5-24.SP12_redhat_00016.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product": {
"name": "eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_id": "eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-picketlink-impl@2.5.5-24.SP12_redhat_00016.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-undertow@2.2.40-2.SP3_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_id": "eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-databind@2.18.8-1.redhat_00003.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_id": "eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-datatype-jdk8@2.18.8-1.redhat_00003.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_id": "eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-datatype-jsr310@2.18.8-1.redhat_00003.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_id": "eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-modules-java8@2.18.8-1.redhat_00003.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_id": "eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-annotations@2.18.8-1.redhat_00003.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-cli@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-commons@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-core-client@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-dto@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-hornetq-protocol@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-hqclient-protocol@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-jdbc-store@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-jms-client@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-jms-server@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-journal@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-ra@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-selector@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-server@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-service-extensions@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product": {
"name": "eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_id": "eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-activemq-artemis-tools@2.16.0-22.redhat_00057.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_id": "eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-module-jaxb-annotations@2.18.8-1.redhat_00003.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_id": "eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-modules-base@2.18.8-1.redhat_00003.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-glassfish-jsf@2.3.14-11.SP11_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-all@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-buffer@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec-dns@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec-haproxy@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec-http@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec-http2@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec-memcache@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec-mqtt@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec-redis@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec-smtp@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec-socks@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec-stomp@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-codec-xml@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-common@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-handler@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-handler-proxy@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-resolver@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-resolver-dns@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-resolver-dns-classes-macos@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-transport@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-transport-classes-epoll@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-transport-classes-kqueue@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-transport-native-unix-common@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-transport-sctp@4.1.135-1.Final_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_id": "eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-core@2.18.8-1.redhat_00003.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_id": "eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-base@2.18.8-1.redhat_00003.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product": {
"name": "eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_id": "eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-json-provider@2.18.8-1.redhat_00003.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly@7.4.25-2.GA_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk11@7.4.25-2.GA_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk8@7.4.25-2.GA_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.4.25-2.GA_redhat_00001.1.el7eap?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product": {
"name": "eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product_id": "eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.4.25-2.GA_redhat_00001.1.el7eap?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"product": {
"name": "eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"product_id": "eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll@4.1.135-1.Final_redhat_00001.1.el7eap?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"product": {
"name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"product_id": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/eap7-netty-transport-native-epoll-debuginfo@4.1.135-1.Final_redhat_00001.1.el7eap?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src"
},
"product_reference": "eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch"
},
"product_reference": "eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src"
},
"product_reference": "eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src"
},
"product_reference": "eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src"
},
"product_reference": "eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src"
},
"product_reference": "eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src"
},
"product_reference": "eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch"
},
"product_reference": "eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src"
},
"product_reference": "eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src"
},
"product_reference": "eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch"
},
"product_reference": "eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64"
},
"product_reference": "eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64 as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64"
},
"product_reference": "eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch"
},
"product_reference": "eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch"
},
"product_reference": "eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src"
},
"product_reference": "eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch"
},
"product_reference": "eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch"
},
"product_reference": "eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch"
},
"product_reference": "eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src"
},
"product_reference": "eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch"
},
"product_reference": "eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch"
},
"product_reference": "eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch"
},
"product_reference": "eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch"
},
"product_reference": "eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch"
},
"product_reference": "eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src"
},
"product_reference": "eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server",
"product_id": "7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
},
"product_reference": "eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"relates_to_product_reference": "7Server-JBEAP-7.4-ELS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-5598",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2026-04-15T10:01:04.531185+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458635"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy to gain unauthorized access to sensitive cryptographic information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an unauthenticated attacker needs to send highly specific, malformed ciphertexts to the target server. These payloads are used to interact with the private key of the server in a way that the vulnerable, non-constant time code paths are triggered during the verification step. An attack typically requires sending a large volume of these requests to perform statistical analysis on the resulting timing variations, increasing its complexity.\nThe primary security impact of this vulnerability is the potential leakage of private keys associated with the FrodoKEM implementation. This can compromise encrypted communications or authentication mechanisms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5598"
},
{
"category": "external",
"summary": "RHBZ#2458635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458635"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5598"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998"
}
],
"release_date": "2026-04-15T09:05:56.277000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement aggressive rate limiting and anomaly detection, specifically looking for unusual, high-frequency cryptographic handshake failures or anomalous traffic patterns targeting endpoints that handle key exchanges in the network logs.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons"
},
{
"cve": "CVE-2026-10579",
"discovery_date": "2026-05-20T22:49:02.313000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "picketlink-federation: auth bypass in Picketlink SAML unsolicited-response",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10579"
},
{
"category": "external",
"summary": "RHBZ#2480325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10579"
}
],
"release_date": "2026-08-11T05:48:48.345000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "picketlink-federation: auth bypass in Picketlink SAML unsolicited-response"
},
{
"cve": "CVE-2026-15554",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-21T19:34:31.218000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480601"
}
],
"notes": [
{
"category": "description",
"text": "the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15554"
},
{
"category": "external",
"summary": "RHBZ#2480601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480601"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15554"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15554",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15554"
}
],
"release_date": "2026-08-11T05:49:31.658000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery"
},
{
"cve": "CVE-2026-15555",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-21T20:47:36.888000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480637"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering \u2014 enabling RCE via deserialization gadget chains on every cluster node.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15555"
},
{
"category": "external",
"summary": "RHBZ#2480637",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480637"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15555"
}
],
"release_date": "2026-08-11T05:49:54.473000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller"
},
{
"cve": "CVE-2026-15556",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T23:46:02.407000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483121"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Picketlink\u0027s SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat JBoss EAP 8.x is not affected. The vulnerable components (`picketlink-federation`, `picketlink-common`) are not shipped in EAP 8.x. The `org/picketlink/` module path does not exist. The only PicketLink-related artifact in EAP 8.1 is `wildfly-picketlink-8.1.1.GA-redhat-00012.jar` \u2014 a WildFly subsystem extension that provides the `migrate` CLI operation for EAP 7\u21928 upgrades. This JAR contains no SAML processing code, no signature validation logic, and has no module dependency on `org.picketlink.federation`. The PicketLink SAML SP code path is entirely absent from EAP 8.x.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15556"
},
{
"category": "external",
"summary": "RHBZ#2483121",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483121"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15556"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15556",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15556"
}
],
"release_date": "2026-08-11T05:54:53.908000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions"
},
{
"cve": "CVE-2026-15560",
"cwe": {
"id": "CWE-829",
"name": "Inclusion of Functionality from Untrusted Control Sphere"
},
"discovery_date": "2026-05-29T00:23:22.856000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483131"
}
],
"notes": [
{
"category": "description",
"text": "when EAP runs with -secmgr, the openjdk-orb\u0027s JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk-orb: unauthed class loading via IIOP in EAP",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15560"
},
{
"category": "external",
"summary": "RHBZ#2483131",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483131"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15560"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15560",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15560"
}
],
"release_date": "2026-08-11T05:52:32.653000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openjdk-orb: unauthed class loading via IIOP in EAP"
},
{
"cve": "CVE-2026-15561",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-29T00:41:31.600000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483133"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in EAP\u0027s undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undertow-core: OOM via missing limits in chunked trailer in EAP\u0027s Undertow",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15561"
},
{
"category": "external",
"summary": "RHBZ#2483133",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483133"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15561"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15561",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15561"
}
],
"release_date": "2026-08-11T05:52:49.718000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undertow-core: OOM via missing limits in chunked trailer in EAP\u0027s Undertow"
},
{
"cve": "CVE-2026-15562",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-05-29T00:52:03.986000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483135"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in EAP\u0027s jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in jboss-remoting affecting Red Hat JBoss Enterprise Application Platform. A remote, unauthenticated attacker can exploit an integer overflow in the MessageReader by completing a jboss-remoting handshake on exposed ports, leading to a severe degradation of server performance and potential resource exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15562"
},
{
"category": "external",
"summary": "RHBZ#2483135",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483135"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15562"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15562",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15562"
}
],
"release_date": "2026-08-11T05:53:34.782000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service"
},
{
"cve": "CVE-2026-15563",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-05-29T01:18:12.701000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483138"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in EAP\u0027s IIOP. The listener\u0027s NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly-iiop-openjdk: Missing authentication on EAP\u0027s IIOP NameService leads to MITM or DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15563"
},
{
"category": "external",
"summary": "RHBZ#2483138",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483138"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15563"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15563",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15563"
}
],
"release_date": "2026-08-11T05:54:01.358000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "wildfly-iiop-openjdk: Missing authentication on EAP\u0027s IIOP NameService leads to MITM or DoS"
},
{
"cve": "CVE-2026-27446",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-03-04T07:02:26.064000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444320"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. The primary consequence is the potential for message injection into any queue and/or message exfiltration from any queue via the rogue broker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as IMPORTANT severity because it does not enable remote code execution or system compromise (arbitrary code execution), which is Red Hat\u0027s threshold for Critical impact. Its impact is limited to message injection and exfiltration via rogue broker federation. Exploitation requires the broker to accept inbound Core protocol connections from untrusted networks with outbound connectivity to attacker-controlled systems. Availability impact is set to None as exploitation does not cause service disruption or broker instability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27446"
},
{
"category": "external",
"summary": "RHBZ#2444320",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444320"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27446"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27446",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27446"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg",
"url": "https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg"
}
],
"release_date": "2026-03-04T06:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict Core protocol support on acceptors receiving connections from untrusted sources. The default \"artemis\" acceptor on port 61616 supports all protocols, including Core. Modify the acceptor URL to explicitly exclude the Core protocol using the \"protocols\" URL parameter. Alternatively, configure two-way SSL with certificate-based authentication to prevent unauthenticated exploitation. A service restart or reload may be required for changes to take effect.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication"
},
{
"cve": "CVE-2026-41417",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-05-06T22:00:55.777954+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467540"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can bypass request-line validation by manipulating the URI after a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created. This vulnerability, a form of Carriage Return Line Feed (CRLF) injection, allows for the insertion of additional HTTP or RTSP requests. The primary consequence is HTTP request smuggling or desynchronization, which can lead to unauthorized access or manipulation of web traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41417"
},
{
"category": "external",
"summary": "RHBZ#2467540",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467540"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41417"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41417",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41417"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv"
}
],
"release_date": "2026-05-06T20:52:47.206000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection"
},
{
"cve": "CVE-2026-42578",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-05-13T19:02:00.826936+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477226"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This vulnerability in Netty\u0027s HttpProxyHandler allows for HTTP header injection into CONNECT requests when an attacker can influence outbound headers. The handler\u0027s explicit disabling of header validation could enable proxy-related attacks, such as cache poisoning or bypassing security controls, impacting applications utilizing this component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42578"
},
{
"category": "external",
"summary": "RHBZ#2477226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
"url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
}
],
"release_date": "2026-05-13T17:57:43.538000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
},
{
"cve": "CVE-2026-42579",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-05-13T19:01:25.062732+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477217"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. Netty\u0027s DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important integrity flaw in Netty\u0027s DNS codec. The vulnerability arises from insufficient enforcement of RFC 1035 domain name constraints during both encoding and decoding, allowing remote attackers to manipulate DNS responses or user-controlled hostnames. This could lead to a high integrity impact on affected Red Hat products that utilize the vulnerable Netty DNS codec.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42579"
},
{
"category": "external",
"summary": "RHBZ#2477217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm",
"url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
}
],
"release_date": "2026-05-13T18:01:52.500000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement"
},
{
"cve": "CVE-2026-42581",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:02:26.404511+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477232"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. Netty\u0027s HttpObjectDecoder, used across various Red Hat products, improperly handles conflicting `Transfer-Encoding: chunked` and `Content-Length` headers in HTTP/1.0 requests. This allows a remote attacker to perform HTTP request smuggling, potentially bypassing security controls or gaining unauthorized access to information due to misinterpretation of message boundaries by downstream proxies or handlers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42581"
},
{
"category": "external",
"summary": "RHBZ#2477232",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
"url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
}
],
"release_date": "2026-05-13T17:54:44.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers"
},
{
"cve": "CVE-2026-42584",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:01:51.846351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477224"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in Netty\u0027s HttpClientCodec allows a remote attacker to cause data confusion. By sending a specially crafted sequence of HTTP responses, an attacker can cause subsequent HTTP responses to be parsed incorrectly, potentially leading to information disclosure or data integrity issues in applications utilizing Netty for HTTP client operations. This vulnerability affects various Red Hat products that bundle Netty, including Red Hat AMQ, Enterprise Application Platform, Red Hat Build of Quarkus, and Red Hat Build of Keycloak.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42584"
},
{
"category": "external",
"summary": "RHBZ#2477224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
}
],
"release_date": "2026-05-13T18:10:48.437000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion"
},
{
"cve": "CVE-2026-42585",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:02:06.067565+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477227"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate web traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP codec allows for request smuggling attacks due to improper parsing of malformed Transfer-Encoding headers. An attacker could exploit this to bypass security controls, potentially leading to unauthorized access to sensitive information or manipulation of web traffic in Red Hat products utilizing affected Netty versions, particularly when deployed behind a proxy or load balancer.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42585"
},
{
"category": "external",
"summary": "RHBZ#2477227",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477227"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42585",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42585"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42585",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42585"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv"
}
],
"release_date": "2026-05-13T18:12:39.586000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-13T19:01:35.415881+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477220"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"category": "external",
"summary": "RHBZ#2477220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"release_date": "2026-05-13T18:22:21.699000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
},
{
"cve": "CVE-2026-44249",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-11T22:02:05.327173+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488081"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in netty-handler is rated as Important because a remote attacker can bypass configured IPv6 subnet filtering rules. This flaw, stemming from an incorrect masking operation, could allow unauthorized access to or exposure of services that are intended to be network-restricted within Red Hat products utilizing the affected Netty component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44249"
},
{
"category": "external",
"summary": "RHBZ#2488081",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44249"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86",
"url": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86"
}
],
"release_date": "2026-06-11T20:46:14.110000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation"
},
{
"cve": "CVE-2026-44250",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-11T22:01:16.373607+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488062"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in netty-codec-redis, affecting Red Hat products that process Redis payloads. A remote attacker can exhaust server memory by sending a crafted Redis payload with deeply nested arrays, leading to an OutOfMemoryError and rendering the service unresponsive. This impact is significant due to the potential for complete service disruption without authentication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44250"
},
{
"category": "external",
"summary": "RHBZ#2488062",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488062"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44250"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44250",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44250"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2",
"url": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2"
}
],
"release_date": "2026-06-11T20:49:00.487000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services utilizing netty-codec-redis to trusted clients and networks only. Implement firewall rules to limit exposure of the Redis service or the application using it to prevent unauthenticated remote attackers from sending malicious payloads. This may impact legitimate client connections if not configured carefully. A service restart may be required for firewall rule changes to take effect.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays"
},
{
"cve": "CVE-2026-44890",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-11T22:00:53.322242+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending specially crafted Redis payloads across multiple connections without proper termination. This can exhaust the server\u0027s direct memory pool, leading to a Denial of Service (DoS) condition where legitimate connections cannot be processed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important as it allows a remote, unauthenticated attacker to cause a denial of service in applications utilizing `netty-codec-redis` or `netty-handler`. By sending specially crafted Redis payloads without proper termination, an attacker can exhaust the server\u0027s direct memory pool, preventing legitimate connections and disrupting service availability. This impacts Red Hat products that process Redis traffic via affected Netty components.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44890"
},
{
"category": "external",
"summary": "RHBZ#2488053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44890"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44890",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44890"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3"
}
],
"release_date": "2026-06-11T20:52:50.980000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads"
},
{
"cve": "CVE-2026-44893",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-06-12T15:01:18.066312+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488383"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important because a remote, unauthenticated attacker can trigger a denial of service in applications utilizing `netty-codec-haproxy`. By sending a specially crafted HAProxy message with a malformed SSL TLV header, an attacker can cause an `IndexOutOfBoundsException`, leading to unreleased memory and resource exhaustion. This can render the affected application unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44893"
},
{
"category": "external",
"summary": "RHBZ#2488383",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488383"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv"
}
],
"release_date": "2026-06-12T14:00:25.801000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message"
},
{
"cve": "CVE-2026-45416",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-12T15:01:45.671884+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488391"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in Netty is rated as Important. It allows a remote attacker to trigger a denial of service by sending a specially crafted TLS ClientHello message. The flaw arises from an eager, unbounded memory allocation during the TLS handshake, particularly when default configurations disable the maximum client hello length guard, leading to excessive resource consumption in affected Red Hat products utilizing Netty.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45416"
},
{
"category": "external",
"summary": "RHBZ#2488391",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh",
"url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"
}
],
"release_date": "2026-06-12T14:10:05.585000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure applications utilizing Netty\u0027s `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application\u0027s documentation for details on configuring Netty\u0027s TLS handler. A restart of the affected application or service is required for the configuration changes to take effect.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake"
},
{
"cve": "CVE-2026-45674",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-06-12T15:02:15.565158+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488400"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses, which could enable an attacker to redirect network traffic or intercept sensitive data from affected applications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important severity flaw in Netty\u0027s DnsResolveContext allows a remote attacker to achieve information disclosure or data manipulation. By crafting malicious DNS responses, an attacker could redirect network traffic or intercept sensitive data, impacting applications utilizing Netty for DNS resolution in Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45674"
},
{
"category": "external",
"summary": "RHBZ#2488400",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488400"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45674",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45674"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc",
"url": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc"
}
],
"release_date": "2026-06-12T14:17:50.203000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation"
},
{
"cve": "CVE-2026-46340",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-12T15:01:34.090215+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488388"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol (SCTP) message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service (DoS) condition. The affected component fails to limit the size or number of these fragments, allowing an attacker to consume excessive system resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important denial of service flaw exists in `netty-transport-sctp`, a component used across various Red Hat products. A remote, unauthenticated attacker can exploit this vulnerability by sending fragmented Stream Control Transmission Protocol (SCTP) messages without the completion flag. This leads to unbounded memory growth and resource exhaustion, causing a complete denial of service for applications utilizing the affected Netty component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46340"
},
{
"category": "external",
"summary": "RHBZ#2488388",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488388"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46340"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46340",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46340"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch",
"url": "https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch"
}
],
"release_date": "2026-06-12T14:19:48.855000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments"
},
{
"cve": "CVE-2026-46581",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-05-29T01:09:27.995000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483136"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46581"
},
{
"category": "external",
"summary": "RHBZ#2483136",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483136"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46581"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46581",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46581"
}
],
"release_date": "2026-08-06T12:01:27.703000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include"
},
{
"cve": "CVE-2026-47691",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-06-12T16:02:45.855856+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488439"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Netty\u0027s DNS resolution component, `netty-resolver-dns`, allows for DNS cache poisoning. An attacker with control over an authoritative name server for a subdomain could exploit this vulnerability to inject malicious DNS records into the cache of parent domains. This could lead to redirection of network traffic, impacting the integrity and availability of services relying on DNS resolution within affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47691"
},
{
"category": "external",
"summary": "RHBZ#2488439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488439"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47691"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85",
"url": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85"
}
],
"release_date": "2026-06-12T14:33:16.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records"
},
{
"cve": "CVE-2026-48006",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-06-12T16:02:27.195680+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488433"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the shared memory pool. Over time, this can exhaust the available memory, causing a Denial of Service (DoS) for all Netty channels in the process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-redis: Netty\u0027s Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s RedisArrayAggregator. Repeated connection churn by a network peer can lead to a permanent leak of direct-memory buffers, eventually exhausting the JVM-wide direct-memory pool. This can cause allocation failures across all Netty channels, impacting the availability and stability of Red Hat products utilizing Netty for Redis communication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48006"
},
{
"category": "external",
"summary": "RHBZ#2488433",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488433"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48006"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48006",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48006"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm",
"url": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm"
}
],
"release_date": "2026-06-12T14:36:44.416000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-redis: Netty\u0027s Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator"
},
{
"cve": "CVE-2026-48043",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-06-12T16:02:56.371830+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488442"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in netty-codec-http2, affecting Red Hat products that utilize HTTP/2 communication with decompression. A remote attacker can exploit a resource leak in the `DelegatingDecompressorFrameListener` by sending malformed HTTP/2 frames, potentially leading to an Out Of Memory Error and causing the Java Virtual Machine to terminate. This could disrupt service availability in affected deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48043"
},
{
"category": "external",
"summary": "RHBZ#2488442",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488442"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48043"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j",
"url": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j"
}
],
"release_date": "2026-06-12T14:39:52.498000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak"
},
{
"cve": "CVE-2026-48059",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-06-12T16:02:40.032749+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488437"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Netty HAProxy PROXY protocol v2 codec, which can lead to a denial of service. A remote attacker can trigger a memory leak by sending a specially crafted HAProxy PROXY protocol v2 header with deeply nested SSL TLV records, causing resource exhaustion in affected Red Hat products that utilize this codec.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48059"
},
{
"category": "external",
"summary": "RHBZ#2488437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488437"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j",
"url": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j"
}
],
"release_date": "2026-06-12T14:42:44.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers"
},
{
"cve": "CVE-2026-50010",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-06-12T16:02:13.735675+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488429"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Netty that affects Red Hat products utilizing the `netty-handler` component, including various Red Hat AMQ, Enterprise Application Platform, and OpenShift offerings. The vulnerability arises when a Netty client is configured with a plain X.509 Trust Manager, leading to a bypass of hostname verification. This oversight allows a remote attacker to perform man-in-the-middle attacks by impersonating a legitimate server, potentially compromising sensitive data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50010"
},
{
"category": "external",
"summary": "RHBZ#2488429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50010"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9",
"url": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9"
}
],
"release_date": "2026-06-12T14:50:43.151000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass"
},
{
"cve": "CVE-2026-50011",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-12T16:01:17.003045+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488413"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. The RedisArrayAggregator component pre-allocates memory based on the declared element count in a Redis array header. A remote attacker can exploit this by sending a small, malicious Redis array header that claims a huge initial capacity, leading to excessive memory pre-allocation. This can result in a denial of service (DoS) due to resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-redis: Netty: Denial of Service via malicious Redis array header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s RedisArrayAggregator component. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted Redis array header, causing excessive memory pre-allocation and leading to resource exhaustion. This can disrupt services utilizing Netty for Redis communication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50011"
},
{
"category": "external",
"summary": "RHBZ#2488413",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488413"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50011"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50011",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50011"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7",
"url": "https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7"
}
],
"release_date": "2026-06-12T14:52:18.042000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services that utilize the netty-codec-redis component and process Redis traffic. Configure firewalls or network access control lists (ACLs) to limit connections to these services from trusted networks or localhost only. This reduces the attack surface by preventing untrusted remote attackers from sending malicious Redis array headers. Consult product-specific documentation for detailed instructions on configuring network access for affected Red Hat products. Reloading or restarting services may be required for network configuration changes to take effect, which could temporarily impact availability.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-redis: Netty: Denial of Service via malicious Redis array header"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-86404",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-15T15:34:21.130000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477930"
}
],
"notes": [
{
"category": "description",
"text": "EAP\u0027s Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86404"
},
{
"category": "external",
"summary": "RHBZ#2477930",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477930"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86404"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86404",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86404"
}
],
"release_date": "2026-08-11T05:45:33.075000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T16:39:22+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"category": "workaround",
"details": "Configure a restrictive deserialization-allow-list on every pooled-connection-factory resource. For example, if your MDBs only expect to receive objects of type com.yourapp.OrderEvent, set the allow-list to \"com.yourapp\". This switches ObjectInputStreamWithClassLoader from \"allow everything\" to \"deny by default, allow only listed classes.\" With this in place, even if an attacker injects a malicious ObjectMessage through any vector, the deserialization of gadget chain classes is blocked.",
"product_ids": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el7eap.x86_64",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap.src",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch",
"7Server-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el7eap.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default"
}
]
}
RHSA-2026:53806
Vulnerability from csaf_redhat - Published: 2026-08-11 17:41 - Updated: 2026-09-09 16:06Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security update
Severity
Important
Notes
Topic: A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.25 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.24, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.25 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* netty-codec-redis: Netty: Denial of Service via malicious Redis array header (CVE-2026-50011)
* netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
* netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays (CVE-2026-44250)
* netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads (CVE-2026-44890)
* netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (CVE-2026-46340)
* netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)
* netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)
* netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (CVE-2026-48006)
* netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
* netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)
* netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043)
* netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893)
* netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing (CVE-2026-42585)
* netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* netty-codec-http: Netty: HTTP request smuggling via URI manipulation and CRLF injection (CVE-2026-41417)
* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)
* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)
* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584)
* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)
* picketlink-federation: auth bypass in Picketlink SAML unsolicited-response (CVE-2026-10579)
* bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcprov-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcprov-jdk15: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcprov-jdk12: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcpg-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
* bcpg-jdk15on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
* bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
* bcpkix-jdk15on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
* bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-jdk15: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-jdk12: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-jdk15: private key leakage via non-constant time comparisons (CVE-2026-5598)
* bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598)
* artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication (CVE-2026-27446)
* netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
* jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
* openjdk-orb: unauthed class loading via IIOP in EAP (CVE-2026-15560)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy to gain unauthorized access to sensitive cryptographic information.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Critical
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. The primary consequence is the potential for message injection into any queue and/or message exfiltration from any queue via the rogue broker.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. A remote attacker can bypass request-line validation by manipulating the URI after a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created. This vulnerability, a form of Carriage Return Line Feed (CRLF) injection, allows for the insertion of additional HTTP or RTSP requests. The primary consequence is HTTP request smuggling or desynchronization, which can lead to unauthorized access or manipulation of web traffic.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. Netty's DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate web traffic.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending specially crafted Redis payloads across multiple connections without proper termination. This can exhaust the server's direct memory pool, leading to a Denial of Service (DoS) condition where legitimate connections cannot be processed.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses, which could enable an attacker to redirect network traffic or intercept sensitive data from affected applications.
8.7 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol (SCTP) message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service (DoS) condition. The affected component fails to limit the size or number of these fragments, allowing an attacker to consume excessive system resources.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty's `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.
8.7 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the shared memory pool. Over time, this can exhaust the available memory, causing a Denial of Service (DoS) for all Netty channels in the process.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. The RedisArrayAggregator component pre-allocates memory based on the declared element count in a Redis array header. A remote attacker can exploit this by sending a small, malicious Redis array header that claims a huge initial capacity, leading to excessive memory pre-allocation. This can result in a denial of service (DoS) due to resource exhaustion.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
References
247 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.25 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.24, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.25 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* netty-codec-redis: Netty: Denial of Service via malicious Redis array header (CVE-2026-50011)\n* netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)\n* netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays (CVE-2026-44250)\n* netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads (CVE-2026-44890)\n* netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (CVE-2026-46340)\n* netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)\n* netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)\n* netty-codec-redis: Netty\u0027s Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (CVE-2026-48006)\n* netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)\n* netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)\n* netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043)\n* netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893)\n* netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing (CVE-2026-42585)\n* netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)\n* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)\n* netty-codec-http: Netty: HTTP request smuggling via URI manipulation and CRLF injection (CVE-2026-41417)\n* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)\n* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)\n* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584)\n* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)\n* picketlink-federation: auth bypass in Picketlink SAML unsolicited-response (CVE-2026-10579)\n* bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n* bcprov-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n* bcprov-jdk15: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n* bcprov-jdk12: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n* bcpg-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)\n* bcpg-jdk15on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)\n* bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)\n* bcpkix-jdk15on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)\n* bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n* bcprov-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n* bcprov-jdk15: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n* bcprov-jdk12: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n* bcprov-jdk15: private key leakage via non-constant time comparisons (CVE-2026-5598)\n* bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598)\n* artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication (CVE-2026-27446)\n* netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)\n* jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)\n* openjdk-orb: unauthed class loading via IIOP in EAP (CVE-2026-15560)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:53806",
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index"
},
{
"category": "external",
"summary": "2444320",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444320"
},
{
"category": "external",
"summary": "2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "2458635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458635"
},
{
"category": "external",
"summary": "2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "2467540",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467540"
},
{
"category": "external",
"summary": "2477217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
},
{
"category": "external",
"summary": "2477220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"category": "external",
"summary": "2477224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
},
{
"category": "external",
"summary": "2477226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
},
{
"category": "external",
"summary": "2477227",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477227"
},
{
"category": "external",
"summary": "2477232",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
},
{
"category": "external",
"summary": "2477930",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477930"
},
{
"category": "external",
"summary": "2480325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480325"
},
{
"category": "external",
"summary": "2480601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480601"
},
{
"category": "external",
"summary": "2480637",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480637"
},
{
"category": "external",
"summary": "2482963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482963"
},
{
"category": "external",
"summary": "2482965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482965"
},
{
"category": "external",
"summary": "2483121",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483121"
},
{
"category": "external",
"summary": "2483131",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483131"
},
{
"category": "external",
"summary": "2483133",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483133"
},
{
"category": "external",
"summary": "2483135",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483135"
},
{
"category": "external",
"summary": "2483136",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483136"
},
{
"category": "external",
"summary": "2483138",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483138"
},
{
"category": "external",
"summary": "2488053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488053"
},
{
"category": "external",
"summary": "2488062",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488062"
},
{
"category": "external",
"summary": "2488081",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
},
{
"category": "external",
"summary": "2488383",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488383"
},
{
"category": "external",
"summary": "2488388",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488388"
},
{
"category": "external",
"summary": "2488391",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
},
{
"category": "external",
"summary": "2488400",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488400"
},
{
"category": "external",
"summary": "2488413",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488413"
},
{
"category": "external",
"summary": "2488429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
},
{
"category": "external",
"summary": "2488433",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488433"
},
{
"category": "external",
"summary": "2488437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488437"
},
{
"category": "external",
"summary": "2488439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488439"
},
{
"category": "external",
"summary": "2488442",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488442"
},
{
"category": "external",
"summary": "2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53806.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security update",
"tracking": {
"current_release_date": "2026-09-09T16:06:44+00:00",
"generator": {
"date": "2026-09-09T16:06:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:53806",
"initial_release_date": "2026-08-11T17:41:19+00:00",
"revision_history": [
{
"date": "2026-08-11T17:41:19+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-24T11:37:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-09T16:06:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 7.4.25",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 7.4.25",
"product_id": "Red Hat JBoss Enterprise Application Platform 7.4.25",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-5598",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2026-04-15T10:01:04.531185+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458635"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy to gain unauthorized access to sensitive cryptographic information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an unauthenticated attacker needs to send highly specific, malformed ciphertexts to the target server. These payloads are used to interact with the private key of the server in a way that the vulnerable, non-constant time code paths are triggered during the verification step. An attack typically requires sending a large volume of these requests to perform statistical analysis on the resulting timing variations, increasing its complexity.\nThe primary security impact of this vulnerability is the potential leakage of private keys associated with the FrodoKEM implementation. This can compromise encrypted communications or authentication mechanisms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5598"
},
{
"category": "external",
"summary": "RHBZ#2458635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458635"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5598"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998"
}
],
"release_date": "2026-04-15T09:05:56.277000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement aggressive rate limiting and anomaly detection, specifically looking for unusual, high-frequency cryptographic handshake failures or anomalous traffic patterns targeting endpoints that handle key exchanges in the network logs.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons"
},
{
"cve": "CVE-2026-10579",
"discovery_date": "2026-05-20T22:49:02.313000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "picketlink-federation: auth bypass in Picketlink SAML unsolicited-response",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10579"
},
{
"category": "external",
"summary": "RHBZ#2480325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10579"
}
],
"release_date": "2026-08-11T05:48:48.345000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "picketlink-federation: auth bypass in Picketlink SAML unsolicited-response"
},
{
"cve": "CVE-2026-15554",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-21T19:34:31.218000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480601"
}
],
"notes": [
{
"category": "description",
"text": "the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15554"
},
{
"category": "external",
"summary": "RHBZ#2480601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480601"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15554"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15554",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15554"
}
],
"release_date": "2026-08-11T05:49:31.658000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery"
},
{
"cve": "CVE-2026-15555",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-21T20:47:36.888000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480637"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering \u2014 enabling RCE via deserialization gadget chains on every cluster node.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15555"
},
{
"category": "external",
"summary": "RHBZ#2480637",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480637"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15555"
}
],
"release_date": "2026-08-11T05:49:54.473000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller"
},
{
"cve": "CVE-2026-15556",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T23:46:02.407000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483121"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Picketlink\u0027s SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat JBoss EAP 8.x is not affected. The vulnerable components (`picketlink-federation`, `picketlink-common`) are not shipped in EAP 8.x. The `org/picketlink/` module path does not exist. The only PicketLink-related artifact in EAP 8.1 is `wildfly-picketlink-8.1.1.GA-redhat-00012.jar` \u2014 a WildFly subsystem extension that provides the `migrate` CLI operation for EAP 7\u21928 upgrades. This JAR contains no SAML processing code, no signature validation logic, and has no module dependency on `org.picketlink.federation`. The PicketLink SAML SP code path is entirely absent from EAP 8.x.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15556"
},
{
"category": "external",
"summary": "RHBZ#2483121",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483121"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15556"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15556",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15556"
}
],
"release_date": "2026-08-11T05:54:53.908000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions"
},
{
"cve": "CVE-2026-15560",
"cwe": {
"id": "CWE-829",
"name": "Inclusion of Functionality from Untrusted Control Sphere"
},
"discovery_date": "2026-05-29T00:23:22.856000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483131"
}
],
"notes": [
{
"category": "description",
"text": "when EAP runs with -secmgr, the openjdk-orb\u0027s JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk-orb: unauthed class loading via IIOP in EAP",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15560"
},
{
"category": "external",
"summary": "RHBZ#2483131",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483131"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15560"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15560",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15560"
}
],
"release_date": "2026-08-11T05:52:32.653000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openjdk-orb: unauthed class loading via IIOP in EAP"
},
{
"cve": "CVE-2026-15561",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-29T00:41:31.600000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483133"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in EAP\u0027s undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undertow-core: OOM via missing limits in chunked trailer in EAP\u0027s Undertow",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15561"
},
{
"category": "external",
"summary": "RHBZ#2483133",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483133"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15561"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15561",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15561"
}
],
"release_date": "2026-08-11T05:52:49.718000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undertow-core: OOM via missing limits in chunked trailer in EAP\u0027s Undertow"
},
{
"cve": "CVE-2026-15562",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-05-29T00:52:03.986000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483135"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in EAP\u0027s jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in jboss-remoting affecting Red Hat JBoss Enterprise Application Platform. A remote, unauthenticated attacker can exploit an integer overflow in the MessageReader by completing a jboss-remoting handshake on exposed ports, leading to a severe degradation of server performance and potential resource exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15562"
},
{
"category": "external",
"summary": "RHBZ#2483135",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483135"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15562"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15562",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15562"
}
],
"release_date": "2026-08-11T05:53:34.782000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service"
},
{
"cve": "CVE-2026-15563",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-05-29T01:18:12.701000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483138"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in EAP\u0027s IIOP. The listener\u0027s NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly-iiop-openjdk: Missing authentication on EAP\u0027s IIOP NameService leads to MITM or DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15563"
},
{
"category": "external",
"summary": "RHBZ#2483138",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483138"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15563"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15563",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15563"
}
],
"release_date": "2026-08-11T05:54:01.358000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "wildfly-iiop-openjdk: Missing authentication on EAP\u0027s IIOP NameService leads to MITM or DoS"
},
{
"cve": "CVE-2026-15565",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-06-19T00:58:08.395000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490628"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15565"
},
{
"category": "external",
"summary": "RHBZ#2490628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15565"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15565",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15565"
},
{
"category": "external",
"summary": "https://cwe.mitre.org/data/definitions/120.html",
"url": "https://cwe.mitre.org/data/definitions/120.html"
}
],
"release_date": "2026-08-11T05:55:42.770000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Option 1 \u2014 Server-wide configuration to disable websockets handshake:\n \u003c!-- Remove \u003cwebsockets/\u003e from standalone.xml servlet-container --\u003e\n \u003cservlet-container name=\"default\"\u003e\n \u003cjsp-config/\u003e\n \u003c!-- \u003cwebsockets/\u003e \u2190 remove this line entirely --\u003e\n \u003c/servlet-container\u003e\n isWebsocketsEnabled() returns false \u2192 no WebSocket upgrade accepted for any deployment.\n\nOption 2 \u2014 Per-application configuration to disable websockets handshake:\n \u003c!-- WEB-INF/jboss-web.xml inside the WAR --\u003e\n \u003cjboss-web\u003e\n \u003cenable-websockets\u003efalse\u003c/enable-websockets\u003e\n \u003c/jboss-web\u003e\n Only that specific WAR\u0027s @ServerEndpoint classes are not registered.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method"
},
{
"cve": "CVE-2026-15567",
"discovery_date": "2026-06-23T03:03:11.963000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491620"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util\u0027s GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15567"
},
{
"category": "external",
"summary": "RHBZ#2491620",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491620"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15567"
}
],
"release_date": "2026-08-11T05:55:33.625000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener"
},
{
"cve": "CVE-2026-27446",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-03-04T07:02:26.064000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444320"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. The primary consequence is the potential for message injection into any queue and/or message exfiltration from any queue via the rogue broker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as IMPORTANT severity because it does not enable remote code execution or system compromise (arbitrary code execution), which is Red Hat\u0027s threshold for Critical impact. Its impact is limited to message injection and exfiltration via rogue broker federation. Exploitation requires the broker to accept inbound Core protocol connections from untrusted networks with outbound connectivity to attacker-controlled systems. Availability impact is set to None as exploitation does not cause service disruption or broker instability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27446"
},
{
"category": "external",
"summary": "RHBZ#2444320",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444320"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27446"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27446",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27446"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg",
"url": "https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg"
}
],
"release_date": "2026-03-04T06:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict Core protocol support on acceptors receiving connections from untrusted sources. The default \"artemis\" acceptor on port 61616 supports all protocols, including Core. Modify the acceptor URL to explicitly exclude the Core protocol using the \"protocols\" URL parameter. Alternatively, configure two-way SSL with certificate-based authentication to prevent unauthenticated exploitation. A service restart or reload may be required for changes to take effect.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication"
},
{
"cve": "CVE-2026-41417",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-05-06T22:00:55.777954+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467540"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can bypass request-line validation by manipulating the URI after a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created. This vulnerability, a form of Carriage Return Line Feed (CRLF) injection, allows for the insertion of additional HTTP or RTSP requests. The primary consequence is HTTP request smuggling or desynchronization, which can lead to unauthorized access or manipulation of web traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41417"
},
{
"category": "external",
"summary": "RHBZ#2467540",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467540"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41417"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41417",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41417"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv"
}
],
"release_date": "2026-05-06T20:52:47.206000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection"
},
{
"cve": "CVE-2026-42578",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-05-13T19:02:00.826936+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477226"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This vulnerability in Netty\u0027s HttpProxyHandler allows for HTTP header injection into CONNECT requests when an attacker can influence outbound headers. The handler\u0027s explicit disabling of header validation could enable proxy-related attacks, such as cache poisoning or bypassing security controls, impacting applications utilizing this component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42578"
},
{
"category": "external",
"summary": "RHBZ#2477226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
"url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
}
],
"release_date": "2026-05-13T17:57:43.538000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
},
{
"cve": "CVE-2026-42579",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-05-13T19:01:25.062732+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477217"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. Netty\u0027s DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important integrity flaw in Netty\u0027s DNS codec. The vulnerability arises from insufficient enforcement of RFC 1035 domain name constraints during both encoding and decoding, allowing remote attackers to manipulate DNS responses or user-controlled hostnames. This could lead to a high integrity impact on affected Red Hat products that utilize the vulnerable Netty DNS codec.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42579"
},
{
"category": "external",
"summary": "RHBZ#2477217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm",
"url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
}
],
"release_date": "2026-05-13T18:01:52.500000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement"
},
{
"cve": "CVE-2026-42581",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:02:26.404511+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477232"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. Netty\u0027s HttpObjectDecoder, used across various Red Hat products, improperly handles conflicting `Transfer-Encoding: chunked` and `Content-Length` headers in HTTP/1.0 requests. This allows a remote attacker to perform HTTP request smuggling, potentially bypassing security controls or gaining unauthorized access to information due to misinterpretation of message boundaries by downstream proxies or handlers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42581"
},
{
"category": "external",
"summary": "RHBZ#2477232",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
"url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
}
],
"release_date": "2026-05-13T17:54:44.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers"
},
{
"cve": "CVE-2026-42584",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:01:51.846351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477224"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in Netty\u0027s HttpClientCodec allows a remote attacker to cause data confusion. By sending a specially crafted sequence of HTTP responses, an attacker can cause subsequent HTTP responses to be parsed incorrectly, potentially leading to information disclosure or data integrity issues in applications utilizing Netty for HTTP client operations. This vulnerability affects various Red Hat products that bundle Netty, including Red Hat AMQ, Enterprise Application Platform, Red Hat Build of Quarkus, and Red Hat Build of Keycloak.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42584"
},
{
"category": "external",
"summary": "RHBZ#2477224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
}
],
"release_date": "2026-05-13T18:10:48.437000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion"
},
{
"cve": "CVE-2026-42585",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:02:06.067565+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477227"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate web traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP codec allows for request smuggling attacks due to improper parsing of malformed Transfer-Encoding headers. An attacker could exploit this to bypass security controls, potentially leading to unauthorized access to sensitive information or manipulation of web traffic in Red Hat products utilizing affected Netty versions, particularly when deployed behind a proxy or load balancer.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42585"
},
{
"category": "external",
"summary": "RHBZ#2477227",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477227"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42585",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42585"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42585",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42585"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv"
}
],
"release_date": "2026-05-13T18:12:39.586000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-13T19:01:35.415881+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477220"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"category": "external",
"summary": "RHBZ#2477220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"release_date": "2026-05-13T18:22:21.699000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
},
{
"cve": "CVE-2026-44249",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-11T22:02:05.327173+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488081"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in netty-handler is rated as Important because a remote attacker can bypass configured IPv6 subnet filtering rules. This flaw, stemming from an incorrect masking operation, could allow unauthorized access to or exposure of services that are intended to be network-restricted within Red Hat products utilizing the affected Netty component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44249"
},
{
"category": "external",
"summary": "RHBZ#2488081",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44249"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86",
"url": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86"
}
],
"release_date": "2026-06-11T20:46:14.110000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation"
},
{
"cve": "CVE-2026-44250",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-11T22:01:16.373607+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488062"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in netty-codec-redis, affecting Red Hat products that process Redis payloads. A remote attacker can exhaust server memory by sending a crafted Redis payload with deeply nested arrays, leading to an OutOfMemoryError and rendering the service unresponsive. This impact is significant due to the potential for complete service disruption without authentication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44250"
},
{
"category": "external",
"summary": "RHBZ#2488062",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488062"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44250"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44250",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44250"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2",
"url": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2"
}
],
"release_date": "2026-06-11T20:49:00.487000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services utilizing netty-codec-redis to trusted clients and networks only. Implement firewall rules to limit exposure of the Redis service or the application using it to prevent unauthenticated remote attackers from sending malicious payloads. This may impact legitimate client connections if not configured carefully. A service restart may be required for firewall rule changes to take effect.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays"
},
{
"cve": "CVE-2026-44890",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-11T22:00:53.322242+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending specially crafted Redis payloads across multiple connections without proper termination. This can exhaust the server\u0027s direct memory pool, leading to a Denial of Service (DoS) condition where legitimate connections cannot be processed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important as it allows a remote, unauthenticated attacker to cause a denial of service in applications utilizing `netty-codec-redis` or `netty-handler`. By sending specially crafted Redis payloads without proper termination, an attacker can exhaust the server\u0027s direct memory pool, preventing legitimate connections and disrupting service availability. This impacts Red Hat products that process Redis traffic via affected Netty components.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44890"
},
{
"category": "external",
"summary": "RHBZ#2488053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44890"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44890",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44890"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3"
}
],
"release_date": "2026-06-11T20:52:50.980000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads"
},
{
"cve": "CVE-2026-44893",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-06-12T15:01:18.066312+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488383"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important because a remote, unauthenticated attacker can trigger a denial of service in applications utilizing `netty-codec-haproxy`. By sending a specially crafted HAProxy message with a malformed SSL TLV header, an attacker can cause an `IndexOutOfBoundsException`, leading to unreleased memory and resource exhaustion. This can render the affected application unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44893"
},
{
"category": "external",
"summary": "RHBZ#2488383",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488383"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv"
}
],
"release_date": "2026-06-12T14:00:25.801000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message"
},
{
"cve": "CVE-2026-45416",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-12T15:01:45.671884+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488391"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in Netty is rated as Important. It allows a remote attacker to trigger a denial of service by sending a specially crafted TLS ClientHello message. The flaw arises from an eager, unbounded memory allocation during the TLS handshake, particularly when default configurations disable the maximum client hello length guard, leading to excessive resource consumption in affected Red Hat products utilizing Netty.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45416"
},
{
"category": "external",
"summary": "RHBZ#2488391",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh",
"url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"
}
],
"release_date": "2026-06-12T14:10:05.585000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure applications utilizing Netty\u0027s `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application\u0027s documentation for details on configuring Netty\u0027s TLS handler. A restart of the affected application or service is required for the configuration changes to take effect.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake"
},
{
"cve": "CVE-2026-45674",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-06-12T15:02:15.565158+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488400"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses, which could enable an attacker to redirect network traffic or intercept sensitive data from affected applications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important severity flaw in Netty\u0027s DnsResolveContext allows a remote attacker to achieve information disclosure or data manipulation. By crafting malicious DNS responses, an attacker could redirect network traffic or intercept sensitive data, impacting applications utilizing Netty for DNS resolution in Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45674"
},
{
"category": "external",
"summary": "RHBZ#2488400",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488400"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45674",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45674"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc",
"url": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc"
}
],
"release_date": "2026-06-12T14:17:50.203000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation"
},
{
"cve": "CVE-2026-46340",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-12T15:01:34.090215+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488388"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol (SCTP) message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service (DoS) condition. The affected component fails to limit the size or number of these fragments, allowing an attacker to consume excessive system resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important denial of service flaw exists in `netty-transport-sctp`, a component used across various Red Hat products. A remote, unauthenticated attacker can exploit this vulnerability by sending fragmented Stream Control Transmission Protocol (SCTP) messages without the completion flag. This leads to unbounded memory growth and resource exhaustion, causing a complete denial of service for applications utilizing the affected Netty component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46340"
},
{
"category": "external",
"summary": "RHBZ#2488388",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488388"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46340"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46340",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46340"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch",
"url": "https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch"
}
],
"release_date": "2026-06-12T14:19:48.855000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments"
},
{
"cve": "CVE-2026-46581",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-05-29T01:09:27.995000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483136"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46581"
},
{
"category": "external",
"summary": "RHBZ#2483136",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483136"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46581"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46581",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46581"
}
],
"release_date": "2026-08-06T12:01:27.703000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include"
},
{
"cve": "CVE-2026-47691",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-06-12T16:02:45.855856+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488439"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Netty\u0027s DNS resolution component, `netty-resolver-dns`, allows for DNS cache poisoning. An attacker with control over an authoritative name server for a subdomain could exploit this vulnerability to inject malicious DNS records into the cache of parent domains. This could lead to redirection of network traffic, impacting the integrity and availability of services relying on DNS resolution within affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47691"
},
{
"category": "external",
"summary": "RHBZ#2488439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488439"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47691"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85",
"url": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85"
}
],
"release_date": "2026-06-12T14:33:16.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records"
},
{
"cve": "CVE-2026-48006",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-06-12T16:02:27.195680+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488433"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the shared memory pool. Over time, this can exhaust the available memory, causing a Denial of Service (DoS) for all Netty channels in the process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-redis: Netty\u0027s Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s RedisArrayAggregator. Repeated connection churn by a network peer can lead to a permanent leak of direct-memory buffers, eventually exhausting the JVM-wide direct-memory pool. This can cause allocation failures across all Netty channels, impacting the availability and stability of Red Hat products utilizing Netty for Redis communication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48006"
},
{
"category": "external",
"summary": "RHBZ#2488433",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488433"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48006"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48006",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48006"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm",
"url": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm"
}
],
"release_date": "2026-06-12T14:36:44.416000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-redis: Netty\u0027s Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator"
},
{
"cve": "CVE-2026-48043",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-06-12T16:02:56.371830+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488442"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in netty-codec-http2, affecting Red Hat products that utilize HTTP/2 communication with decompression. A remote attacker can exploit a resource leak in the `DelegatingDecompressorFrameListener` by sending malformed HTTP/2 frames, potentially leading to an Out Of Memory Error and causing the Java Virtual Machine to terminate. This could disrupt service availability in affected deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48043"
},
{
"category": "external",
"summary": "RHBZ#2488442",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488442"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48043"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j",
"url": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j"
}
],
"release_date": "2026-06-12T14:39:52.498000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak"
},
{
"cve": "CVE-2026-48059",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-06-12T16:02:40.032749+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488437"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Netty HAProxy PROXY protocol v2 codec, which can lead to a denial of service. A remote attacker can trigger a memory leak by sending a specially crafted HAProxy PROXY protocol v2 header with deeply nested SSL TLV records, causing resource exhaustion in affected Red Hat products that utilize this codec.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48059"
},
{
"category": "external",
"summary": "RHBZ#2488437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488437"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j",
"url": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j"
}
],
"release_date": "2026-06-12T14:42:44.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers"
},
{
"cve": "CVE-2026-50010",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-06-12T16:02:13.735675+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488429"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Netty that affects Red Hat products utilizing the `netty-handler` component, including various Red Hat AMQ, Enterprise Application Platform, and OpenShift offerings. The vulnerability arises when a Netty client is configured with a plain X.509 Trust Manager, leading to a bypass of hostname verification. This oversight allows a remote attacker to perform man-in-the-middle attacks by impersonating a legitimate server, potentially compromising sensitive data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50010"
},
{
"category": "external",
"summary": "RHBZ#2488429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50010"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9",
"url": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9"
}
],
"release_date": "2026-06-12T14:50:43.151000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass"
},
{
"cve": "CVE-2026-50011",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-12T16:01:17.003045+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488413"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. The RedisArrayAggregator component pre-allocates memory based on the declared element count in a Redis array header. A remote attacker can exploit this by sending a small, malicious Redis array header that claims a huge initial capacity, leading to excessive memory pre-allocation. This can result in a denial of service (DoS) due to resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-redis: Netty: Denial of Service via malicious Redis array header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s RedisArrayAggregator component. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted Redis array header, causing excessive memory pre-allocation and leading to resource exhaustion. This can disrupt services utilizing Netty for Redis communication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50011"
},
{
"category": "external",
"summary": "RHBZ#2488413",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488413"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50011"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50011",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50011"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7",
"url": "https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7"
}
],
"release_date": "2026-06-12T14:52:18.042000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services that utilize the netty-codec-redis component and process Redis traffic. Configure firewalls or network access control lists (ACLs) to limit connections to these services from trusted networks or localhost only. This reduces the attack surface by preventing untrusted remote attackers from sending malicious Redis array headers. Consult product-specific documentation for detailed instructions on configuring network access for affected Red Hat products. Reloading or restarting services may be required for network configuration changes to take effect, which could temporarily impact availability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty-codec-redis: Netty: Denial of Service via malicious Redis array header"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-11T17:41:19+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 7.4.25"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
}
]
}
RHSA-2026:60239
Vulnerability from csaf_redhat - Published: 2026-08-26 10:22 - Updated: 2026-09-08 22:40Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60239",
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60239.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.",
"tracking": {
"current_release_date": "2026-09-08T22:40:13+00:00",
"generator": {
"date": "2026-09-08T22:40:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.17"
}
},
"id": "RHSA-2026:60239",
"initial_release_date": "2026-08-26T10:22:36+00:00",
"revision_history": [
{
"date": "2026-08-26T10:22:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-08T22:40:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.15",
"product": {
"name": "OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.15::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3Ad478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533565"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533565"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533565"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533565"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64 as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64 as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64 as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64 as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x as a component of OpenShift Developer Tools and Services 4.15",
"product_id": "OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:22:36+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:36406057b4fe044790d32444074185844227d5f92b8611efa5cb0c01cc537f0d_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c2bbcce7225a4e3bfce5be101f71291dcce77bc9979ef73273a08c3732a759b_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9dee95b6882a0450e54998e28408bf6a3769a31abc478f5ec2155acd95759d35_s390x",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:d478dc42fb478c89d3f7a3b506b9852ba3f72820e0cdd8e882452d479276083a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:37dd5afbdaa9ba1402ac6757bd0c51bfd7e965499f94a94c06770c7d4bf46a93_arm64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:40d8b88bbe9099090a13ed3b8c90ad81667e7cd7bfa3913b00ab59149ed79ac9_ppc64le",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5d5328ff56d7cff72402a1475c5aded6a3fbb76d283075a00d1083ea2a58037a_amd64",
"OpenShift Developer Tools and Services 4.15:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:6cfea92fa5f74bf4f2ba11c3fabcaa10de1f1c44e9b3c35fca0c71408dc6308a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60246
Vulnerability from csaf_redhat - Published: 2026-08-26 10:41 - Updated: 2026-09-08 22:40Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60246",
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60246.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.",
"tracking": {
"current_release_date": "2026-09-08T22:40:20+00:00",
"generator": {
"date": "2026-09-08T22:40:20+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.17"
}
},
"id": "RHSA-2026:60246",
"initial_release_date": "2026-08-26T10:41:50+00:00",
"revision_history": [
{
"date": "2026-08-26T10:41:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-08T22:40:20+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.17",
"product": {
"name": "OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.17::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Aa0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124986"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124635"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124986"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Aaefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124635"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124986"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124635"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Af3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124986"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124635"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64 as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64 as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64 as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64 as a component of OpenShift Developer Tools and Services 4.17",
"product_id": "OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.17"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:41:50+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0e88593feff3115efd509aba002dfa8608cdf93f98845c76dad8dab6099ea3cd_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8b964793fc89519100abca6801b2f65e62eb67526ef89fd322c78b129f1f5191_arm64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0a915479ad2a784bbbd1cbbef51ca1a69a37b7c9f496cbb53182802e085bd3d_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:f3e4b8da3efbd3976db770dd7e84a63c98476578b2f4151354fd05ab00c3c0b5_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:14eee04312ebb032755dff97021736569979eb87ee6a96ec592b3d1791732cfe_ppc64le",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:5c41bf031b295d6773099ecb09857b2afcd2c14235e85d9deab37eda1ff19f94_s390x",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:7e4a9fe0b2881fecd816ef99777a45ced93427988b1a9eff0acbcc4d12d0454e_amd64",
"OpenShift Developer Tools and Services 4.17:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:aefa004885cff2364970e66a5c0d7afb8ad76eb107320136256ef564aed71da1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60247
Vulnerability from csaf_redhat - Published: 2026-08-26 10:45 - Updated: 2026-09-08 22:40Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60247",
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60247.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.",
"tracking": {
"current_release_date": "2026-09-08T22:40:16+00:00",
"generator": {
"date": "2026-09-08T22:40:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.17"
}
},
"id": "RHSA-2026:60247",
"initial_release_date": "2026-08-26T10:45:49+00:00",
"revision_history": [
{
"date": "2026-08-26T10:45:49+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-08T22:40:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.12",
"product": {
"name": "OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.12::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628706"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3Ae79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786628667"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 as a component of OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 as a component of OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:45:49+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60248
Vulnerability from csaf_redhat - Published: 2026-08-26 10:46 - Updated: 2026-09-08 22:40Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60248",
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60248.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.",
"tracking": {
"current_release_date": "2026-09-08T22:40:16+00:00",
"generator": {
"date": "2026-09-08T22:40:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.17"
}
},
"id": "RHSA-2026:60248",
"initial_release_date": "2026-08-26T10:46:16+00:00",
"revision_history": [
{
"date": "2026-08-26T10:46:16+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-08T22:40:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.14",
"product": {
"name": "OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.14::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3Ae6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3Adf06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60249
Vulnerability from csaf_redhat - Published: 2026-08-26 10:48 - Updated: 2026-09-08 22:40Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60249",
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60249.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.",
"tracking": {
"current_release_date": "2026-09-08T22:40:16+00:00",
"generator": {
"date": "2026-09-08T22:40:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.17"
}
},
"id": "RHSA-2026:60249",
"initial_release_date": "2026-08-26T10:48:04+00:00",
"revision_history": [
{
"date": "2026-08-26T10:48:04+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-08T22:40:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.13",
"product": {
"name": "OpenShift Developer Tools and Services 4.13",
"product_id": "OpenShift Developer Tools and Services 4.13",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.13::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786628681"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 as a component of OpenShift Developer Tools and Services 4.13",
"product_id": "OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.13"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 as a component of OpenShift Developer Tools and Services 4.13",
"product_id": "OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.13"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60250
Vulnerability from csaf_redhat - Published: 2026-08-26 10:51 - Updated: 2026-09-08 22:40Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60250",
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60250.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.",
"tracking": {
"current_release_date": "2026-09-08T22:40:16+00:00",
"generator": {
"date": "2026-09-08T22:40:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.17"
}
},
"id": "RHSA-2026:60250",
"initial_release_date": "2026-08-26T10:51:30+00:00",
"revision_history": [
{
"date": "2026-08-26T10:51:30+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-08T22:40:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.18",
"product": {
"name": "OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.18::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Ab92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Ad455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ad31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Aff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60251
Vulnerability from csaf_redhat - Published: 2026-08-26 10:51 - Updated: 2026-09-08 22:40Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60251",
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60251.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.",
"tracking": {
"current_release_date": "2026-09-08T22:40:16+00:00",
"generator": {
"date": "2026-09-08T22:40:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.17"
}
},
"id": "RHSA-2026:60251",
"initial_release_date": "2026-08-26T10:51:34+00:00",
"revision_history": [
{
"date": "2026-08-26T10:51:34+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-08T22:40:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.16",
"product": {
"name": "OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.16::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Acb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Afecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ac23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…