RHSA-2026:73976

Vulnerability from csaf_redhat - Published: 2026-09-30 14:04 - Updated: 2026-10-01 23:39
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.16 security update
Severity
Important
Notes
Topic: A security update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.16 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.15, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.16 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects [eap-7.1.z] (CVE-2026-27727) * com.mchange/c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects [eap-7.1.z] (CVE-2026-27830) * netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder [eap-7.1.z] (CVE-2026-42583) * netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [eap-7.1.z] (CVE-2026-42578) * netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [eap-7.1.z] (CVE-2026-42581) * netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing [eap-7.1.z] (CVE-2026-42585) * netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [eap-7.1.z] (CVE-2026-42584) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-27727

A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted `javax.naming.Reference` or serialized object to an application using the library. This can provoke the application to download and execute arbitrary malicious code due to mchange-commons-java's independent implementation of Java Naming and Directory Interface (JNDI) dereferencing, which supports remote code loading. This could lead to arbitrary code execution within the affected application.

8.3 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Affected products
Product Identifier Version Remediation
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src —
Vendor Fix fix
Workaround
Unresolved product id: 7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-27830

A flaw was found in c3p0, a Java Database Connectivity (JDBC) Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or `javax.naming.Reference` instances. By manipulating the `userOverridesAsString` property, an attacker can cause the application to download and execute malicious code from a remote location on its CLASSPATH.

8.0 (High)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Affected products
Fixed 13 products, the same list as for CVE-2026-27727
Threats
Impact Important
CVE-2026-42578

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected products
Fixed 13 products, the same list as for CVE-2026-27727
Threats
Impact Important
CVE-2026-42581

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.

7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 13 products, the same list as for CVE-2026-27727
Threats
Impact Important
CVE-2026-42583

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory (up to 32 MB per block) before the LZ4 decompression runs, leading to excessive memory consumption and a denial of service (DoS) for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 13 products, the same list as for CVE-2026-27727
Threats
Impact Important
CVE-2026-42584

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.

7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 13 products, the same list as for CVE-2026-27727
Threats
Impact Important
CVE-2026-42585

A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate web traffic.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 13 products, the same list as for CVE-2026-27727
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2026:73976 self
https://access.redhat.com/security/updates/classi… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://bugzilla.redhat.com/show_bug.cgi?id=2442671 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442908 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477219 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477224 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477226 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477227 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477232 external
https://issues.redhat.com/browse/JBEAP-33911 external
https://issues.redhat.com/browse/JBEAP-34006 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-27727 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442671 external
https://www.cve.org/CVERecord?id=CVE-2026-27727 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27727 external
https://github.com/swaldman/mchange-commons-java/… external
https://mogwailabs.de/en/blog/2025/02/c3p0-you-li… external
https://www.mchange.com/projects/c3p0/#configurin… external
https://www.mchange.com/projects/c3p0/#security-note external
https://access.redhat.com/security/cve/CVE-2026-27830 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442908 external
https://www.cve.org/CVERecord?id=CVE-2026-27830 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27830 external
https://github.com/swaldman/c3p0/commit/e14cbd816… external
https://github.com/swaldman/c3p0/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-42578 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477226 external
https://www.cve.org/CVERecord?id=CVE-2026-42578 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42578 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42581 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477232 external
https://www.cve.org/CVERecord?id=CVE-2026-42581 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42581 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42583 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477219 external
https://www.cve.org/CVERecord?id=CVE-2026-42583 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42583 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42584 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477224 external
https://www.cve.org/CVERecord?id=CVE-2026-42584 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42584 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42585 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477227 external
https://www.cve.org/CVERecord?id=CVE-2026-42585 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42585 external
https://github.com/netty/netty/security/advisorie… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.16 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.15, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.16 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* mchange-commons-java: mchange-commons-java: Arbitrary code execution via\nJNDI dereferencing of crafted objects [eap-7.1.z] (CVE-2026-27727)\n\n* com.mchange/c3p0: c3p0: Arbitrary Code Execution via deserialization of\ncrafted objects [eap-7.1.z] (CVE-2026-27830)\n\n* netty-codec: Netty: Denial of Service via excessive memory allocation in\nLZ4FrameDecoder [eap-7.1.z] (CVE-2026-42583)\n\n* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [eap-7.1.z] (CVE-2026-42578)\n\n* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling\nof conflicting HTTP/1.0 headers [eap-7.1.z] (CVE-2026-42581)\n\n* netty-codec-http: Netty: Request smuggling via malformed\nTransfer-Encoding parsing [eap-7.1.z] (CVE-2026-42585)\n\n* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data\nconfusion [eap-7.1.z] (CVE-2026-42584)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:73976",
        "url": "https://access.redhat.com/errata/RHSA-2026:73976"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/7.1.0_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/7.1.0_release_notes/index"
      },
      {
        "category": "external",
        "summary": "2442671",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442671"
      },
      {
        "category": "external",
        "summary": "2442908",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442908"
      },
      {
        "category": "external",
        "summary": "2477219",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477219"
      },
      {
        "category": "external",
        "summary": "2477224",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
      },
      {
        "category": "external",
        "summary": "2477226",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
      },
      {
        "category": "external",
        "summary": "2477227",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477227"
      },
      {
        "category": "external",
        "summary": "2477232",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
      },
      {
        "category": "external",
        "summary": "JBEAP-33911",
        "url": "https://issues.redhat.com/browse/JBEAP-33911"
      },
      {
        "category": "external",
        "summary": "JBEAP-34006",
        "url": "https://issues.redhat.com/browse/JBEAP-34006"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73976.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.16 security update",
    "tracking": {
      "current_release_date": "2026-10-01T23:39:19+00:00",
      "generator": {
        "date": "2026-10-01T23:39:19+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:73976",
      "initial_release_date": "2026-09-30T14:04:05+00:00",
      "revision_history": [
        {
          "date": "2026-09-30T14:04:05+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-30T14:04:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-01T23:39:19+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
                  "product_id": "7Server-JBEAP-7.1-EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
                "product": {
                  "name": "eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
                  "product_id": "eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-hibernate@5.1.17-5.Final_redhat_00006.1.ep7.el7?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
                "product": {
                  "name": "eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
                  "product_id": "eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-netty@4.1.63-4.Final_redhat_00005.1.ep7.el7?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
                "product": {
                  "name": "eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
                  "product_id": "eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly@7.1.16-1.GA_redhat_00002.1.ep7.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                "product": {
                  "name": "eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_id": "eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-hibernate@5.1.17-5.Final_redhat_00006.1.ep7.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                "product": {
                  "name": "eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_id": "eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-hibernate-core@5.1.17-5.Final_redhat_00006.1.ep7.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                "product": {
                  "name": "eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_id": "eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-hibernate-entitymanager@5.1.17-5.Final_redhat_00006.1.ep7.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                "product": {
                  "name": "eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_id": "eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-hibernate-envers@5.1.17-5.Final_redhat_00006.1.ep7.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                "product": {
                  "name": "eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_id": "eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-hibernate-infinispan@5.1.17-5.Final_redhat_00006.1.ep7.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                "product": {
                  "name": "eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_id": "eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-hibernate-java8@5.1.17-5.Final_redhat_00006.1.ep7.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
                "product": {
                  "name": "eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
                  "product_id": "eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-netty@4.1.63-4.Final_redhat_00005.1.ep7.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
                "product": {
                  "name": "eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
                  "product_id": "eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-netty-all@4.1.63-4.Final_redhat_00005.1.ep7.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
                "product": {
                  "name": "eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
                  "product_id": "eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly@7.1.16-1.GA_redhat_00002.1.ep7.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
                "product": {
                  "name": "eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
                  "product_id": "eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.1.16-1.GA_redhat_00002.1.ep7.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch"
        },
        "product_reference": "eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src"
        },
        "product_reference": "eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch"
        },
        "product_reference": "eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch"
        },
        "product_reference": "eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch"
        },
        "product_reference": "eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch"
        },
        "product_reference": "eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch"
        },
        "product_reference": "eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch"
        },
        "product_reference": "eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src"
        },
        "product_reference": "eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch"
        },
        "product_reference": "eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
        },
        "product_reference": "eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src"
        },
        "product_reference": "eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
        },
        "product_reference": "eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.1-EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27727",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-02-25T17:04:31.254239+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442671"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted `javax.naming.Reference` or serialized object to an application using the library. This can provoke the application to download and execute arbitrary malicious code due to mchange-commons-java\u0027s independent implementation of Java Naming and Directory Interface (JNDI) dereferencing, which supports remote code loading. This could lead to arbitrary code execution within the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27727"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442671",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442671"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27727",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27727"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27727",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27727"
        },
        {
          "category": "external",
          "summary": "https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44",
          "url": "https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44"
        },
        {
          "category": "external",
          "summary": "https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal",
          "url": "https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal"
        },
        {
          "category": "external",
          "summary": "https://www.mchange.com/projects/c3p0/#configuring_security",
          "url": "https://www.mchange.com/projects/c3p0/#configuring_security"
        },
        {
          "category": "external",
          "summary": "https://www.mchange.com/projects/c3p0/#security-note",
          "url": "https://www.mchange.com/projects/c3p0/#security-note"
        }
      ],
      "release_date": "2026-02-25T16:01:04.187000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-30T14:04:05+00:00",
          "details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73976"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects"
    },
    {
      "cve": "CVE-2026-27830",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-02-26T01:01:56.834884+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442908"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in c3p0, a Java Database Connectivity (JDBC) Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or `javax.naming.Reference` instances. By manipulating the `userOverridesAsString` property, an attacker can cause the application to download and execute malicious code from a remote location on its CLASSPATH.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27830"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442908",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442908"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27830",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27830"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27830",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27830"
        },
        {
          "category": "external",
          "summary": "https://github.com/swaldman/c3p0/commit/e14cbd8166e423e2e9a9d6f08b2add3433492d6e",
          "url": "https://github.com/swaldman/c3p0/commit/e14cbd8166e423e2e9a9d6f08b2add3433492d6e"
        },
        {
          "category": "external",
          "summary": "https://github.com/swaldman/c3p0/security/advisories/GHSA-5476-xc4j-rqcv",
          "url": "https://github.com/swaldman/c3p0/security/advisories/GHSA-5476-xc4j-rqcv"
        },
        {
          "category": "external",
          "summary": "https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal",
          "url": "https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal"
        },
        {
          "category": "external",
          "summary": "https://www.mchange.com/projects/c3p0/#configuring_security",
          "url": "https://www.mchange.com/projects/c3p0/#configuring_security"
        },
        {
          "category": "external",
          "summary": "https://www.mchange.com/projects/c3p0/#security-note",
          "url": "https://www.mchange.com/projects/c3p0/#security-note"
        }
      ],
      "release_date": "2026-02-26T00:45:18.222000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-30T14:04:05+00:00",
          "details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73976"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects"
    },
    {
      "cve": "CVE-2026-42578",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-05-13T19:02:00.826936+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477226"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This vulnerability in Netty\u0027s HttpProxyHandler allows for HTTP header injection into CONNECT requests when an attacker can influence outbound headers. The handler\u0027s explicit disabling of header validation could enable proxy-related attacks, such as cache poisoning or bypassing security controls, impacting applications utilizing this component.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42578"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477226",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42578",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
        }
      ],
      "release_date": "2026-05-13T17:57:43.538000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-30T14:04:05+00:00",
          "details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73976"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface.",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
    },
    {
      "cve": "CVE-2026-42581",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-05-13T19:02:26.404511+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477232"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. Netty\u0027s HttpObjectDecoder, used across various Red Hat products, improperly handles conflicting `Transfer-Encoding: chunked` and `Content-Length` headers in HTTP/1.0 requests. This allows a remote attacker to perform HTTP request smuggling, potentially bypassing security controls or gaining unauthorized access to information due to misinterpretation of message boundaries by downstream proxies or handlers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42581"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477232",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42581",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
        }
      ],
      "release_date": "2026-05-13T17:54:44.492000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-30T14:04:05+00:00",
          "details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73976"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks.",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers"
    },
    {
      "cve": "CVE-2026-42583",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-13T19:01:32.498598+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477219"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory (up to 32 MB per block) before the LZ4 decompression runs, leading to excessive memory consumption and a denial of service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Netty\u0027s LZ4FrameDecoder. The decoder allocates a buffer based on the decompressed length from the LZ4 frame header (up to 32 MB per block) before decompression runs. A remote attacker can send a small crafted LZ4 header (as few as 22 bytes) to force excessive memory allocation, leading to a denial of service. Red Hat products that use Netty with LZ4 compression enabled are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42583"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477219",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477219"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42583",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42583"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42583",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42583"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6"
        }
      ],
      "release_date": "2026-05-13T18:09:19.817000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-30T14:04:05+00:00",
          "details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73976"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder"
    },
    {
      "cve": "CVE-2026-42584",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-05-13T19:01:51.846351+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477224"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A flaw in Netty\u0027s HttpClientCodec allows a remote attacker to cause data confusion. By sending a specially crafted sequence of HTTP responses, an attacker can cause subsequent HTTP responses to be parsed incorrectly, potentially leading to information disclosure or data integrity issues in applications utilizing Netty for HTTP client operations. This vulnerability affects various Red Hat products that bundle Netty, including Red Hat AMQ, Enterprise Application Platform, Red Hat Build of Quarkus, and Red Hat Build of Keycloak.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42584"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477224",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42584",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
        }
      ],
      "release_date": "2026-05-13T18:10:48.437000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-30T14:04:05+00:00",
          "details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73976"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion"
    },
    {
      "cve": "CVE-2026-42585",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-05-13T19:02:06.067565+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477227"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate web traffic.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Netty\u0027s HTTP codec allows for request smuggling attacks due to improper parsing of malformed Transfer-Encoding headers. An attacker could exploit this to bypass security controls, potentially leading to unauthorized access to sensitive information or manipulation of web traffic in Red Hat products utilizing affected Netty versions, particularly when deployed behind a proxy or load balancer.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
          "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42585"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477227",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477227"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42585",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42585"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42585",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42585"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv"
        }
      ],
      "release_date": "2026-05-13T18:12:39.586000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-30T14:04:05+00:00",
          "details": "Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73976"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-core-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-entitymanager-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-envers-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-infinispan-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-hibernate-java8-0:5.1.17-5.Final_redhat_00006.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-netty-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-netty-all-0:4.1.63-4.Final_redhat_00005.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.src",
            "7Server-JBEAP-7.1-EUS:eap7-wildfly-modules-0:7.1.16-1.GA_redhat_00002.1.ep7.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.