RHSA-2026:95221
Vulnerability from csaf_redhat - Published: 2026-11-04 14:44 - Updated: 2026-11-04 14:47Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 XP 6.0.7.GA release
Severity
Important
Notes
Topic: JBoss EAP XP 6.0.7.GA release on the EAP 8.1.9 base. See references for release notes.
Details: This is a cumulative patch release zip for the JBoss EAP XP 6.0.7 runtime distribution for use with EAP 8.1.9
Security Fix(es):
* netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) [eapxp-6] (CVE-2026-93579)
* netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority [eapxp-6] (CVE-2026-93569)
* netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests [eapxp-6] (CVE-2026-93568)
* netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority [eapxp-6] (CVE-2026-93567)
* netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size [eapxp-6] (CVE-2026-93492)
* netty-codec-http2: Netty: Information disclosure via CORS Vary header overwrite [eapxp-6] (CVE-2026-59903)
* netty-buffer: Netty: Information disclosure via CORS Vary header overwrite [eapxp-6] (CVE-2026-59903)
* parent: Apache ZooKeeper: Operational log forgery via newline injection [eapxp-6] (CVE-2026-84501)
* zookeeper: Apache ZooKeeper: Operational log forgery via newline injection [eapxp-6] (CVE-2026-84501)
* parent: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [eapxp-6] (CVE-2026-59969)
* zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [eapxp-6] (CVE-2026-59969)
* resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config [eapxp-6] (CVE-2026-89058)
* resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) [eapxp-6] (CVE-2026-89059)
* zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [eapxp-6] (CVE-2026-90852)
* zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [eapxp-6] (CVE-2026-90560)
* jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing [eapxp-6] (CVE-2026-68497)
* zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [eapxp-6] (CVE-2026-89046)
* zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [eapxp-6] (CVE-2026-87824)
* zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [eapxp-6] (CVE-2026-87795)
* zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [eapxp-6] (CVE-2026-87877)
* zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [eapxp-6] (CVE-2026-87825)
* micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing [eapxp-6] (CVE-2026-59296)
* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching [eapxp-6] (CVE-2026-66257)
* proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation [eapxp-6] (CVE-2026-66273)
* resteasy-core: RESTeasy SourceProvider remote unauthenticated file read [eapxp-6] (CVE-2026-17615)
* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting [eapxp-6] (CVE-2026-66274)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary metrics, including critical system or business metrics, and the injection of false log entries, potentially impacting monitoring and auditing systems.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Moderate
A flaw was found in Netty, an asynchronous, event-driven network application framework. The `CorsHandler` component incorrectly replaces application `Vary` headers, such as `Authorization` or `Cookie`, with `Origin`. This allows a caching proxy or Content Delivery Network (CDN) to reuse authenticated responses across different users, leading to the disclosure of sensitive information.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Moderate
A flaw was found in Apache ZooKeeper. When operating in FIPS (Federal Information Processing Standards) mode with specific Transport Layer Security (TLS) settings enabled, ZooKeeper's quorum communication fails to properly verify the hostname of peer certificates. This vulnerability allows a malicious actor, using a specially crafted or misissued certificate, to join the ZooKeeper cluster. Such an actor could then participate in critical operations like leader election and data replication, potentially leading to unauthorized access or disruption of the ZooKeeper service.
9.0 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service (DoS). A denial of service attack makes the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in Apache ZooKeeper. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a specially crafted request containing newline characters. This vulnerability allows the attacker to forge complete log entries, including timestamps, log levels, and messages. These forged entries are visually indistinguishable from genuine ZooKeeper log output, which could lead to misinterpretation of system activity and hinder incident response efforts.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Moderate
A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the `ZstdDictCompress` constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of sensitive native heap memory and cause the Java Virtual Machine (JVM) to crash, leading to a denial of service.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in zstd-jni. Attackers can exploit this by supplying oversized per-sample lengths to the `Zstd.trainFromBufferDirect` function, which fails to validate the samples buffer capacity. This allows for reading past buffer boundaries, leading to out-of-bounds memory access and ultimately causing the Java Virtual Machine (JVM) to terminate, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in zstd-jni. This use-after-free vulnerability occurs because streams and contexts only hold a dictionary's shared lock during the load call, allowing the dictionary to be closed while still being referenced. A remote attacker could exploit this by closing a dictionary after associating it with a stream or context. Subsequent read or write operations would then access freed native memory, leading to silent data corruption or a Java Virtual Machine (JVM) crash, resulting in a denial of service.
7.7 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in zstd-jni. An attacker could exploit a use-after-free vulnerability by calling specific methods on closed streams without proper validation. This could lead to memory corruption, potentially allowing the attacker to corrupt unrelated objects or cause the Java Virtual Machine (JVM) to crash, resulting in a denial of service.
7.7 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parser. This can lead to out-of-bounds memory reads, resulting in information disclosure or a Java Virtual Machine (JVM) crash.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Moderate
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading to memory being read beyond its allocated buffer. This could result in the termination of the Java Virtual Machine (JVM), causing a denial of service.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in luben zstd-jni. This flaw involves a use-after-free vulnerability in the ZstdCompressCtx.loadDict function, which handles dictionary sharing. A remote attacker could exploit this by manipulating dictionary sharing operations, potentially leading to denial of service, information disclosure, or arbitrary code execution.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Moderate
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Important
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17615
Threats
Impact
Moderate
References
192 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "JBoss EAP XP 6.0.7.GA release on the EAP 8.1.9 base. See references for release notes.",
"title": "Topic"
},
{
"category": "general",
"text": "This is a cumulative patch release zip for the JBoss EAP XP 6.0.7 runtime distribution for use with EAP 8.1.9\n\nSecurity Fix(es):\n\n* netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) [eapxp-6] (CVE-2026-93579)\n\n* netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority [eapxp-6] (CVE-2026-93569)\n\n* netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests [eapxp-6] (CVE-2026-93568)\n\n* netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority [eapxp-6] (CVE-2026-93567)\n\n* netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size [eapxp-6] (CVE-2026-93492)\n\n* netty-codec-http2: Netty: Information disclosure via CORS Vary header overwrite [eapxp-6] (CVE-2026-59903)\n\n* netty-buffer: Netty: Information disclosure via CORS Vary header overwrite [eapxp-6] (CVE-2026-59903)\n\n* parent: Apache ZooKeeper: Operational log forgery via newline injection [eapxp-6] (CVE-2026-84501)\n\n* zookeeper: Apache ZooKeeper: Operational log forgery via newline injection [eapxp-6] (CVE-2026-84501)\n\n* parent: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [eapxp-6] (CVE-2026-59969)\n\n* zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [eapxp-6] (CVE-2026-59969)\n\n* resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config [eapxp-6] (CVE-2026-89058)\n\n* resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) [eapxp-6] (CVE-2026-89059)\n\n* zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [eapxp-6] (CVE-2026-90852)\n\n* zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [eapxp-6] (CVE-2026-90560)\n\n* jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing [eapxp-6] (CVE-2026-68497)\n\n* zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [eapxp-6] (CVE-2026-89046)\n\n* zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [eapxp-6] (CVE-2026-87824)\n\n* zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [eapxp-6] (CVE-2026-87795)\n\n* zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [eapxp-6] (CVE-2026-87877)\n\n* zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [eapxp-6] (CVE-2026-87825)\n\n* micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing [eapxp-6] (CVE-2026-59296)\n\n* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching [eapxp-6] (CVE-2026-66257)\n\n* proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation [eapxp-6] (CVE-2026-66273)\n\n* resteasy-core: RESTeasy SourceProvider remote unauthenticated file read [eapxp-6] (CVE-2026-17615)\n\n* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting [eapxp-6] (CVE-2026-66274)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:95221",
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1"
},
{
"category": "external",
"summary": "2507635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507635"
},
{
"category": "external",
"summary": "2511322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511322"
},
{
"category": "external",
"summary": "2511326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511326"
},
{
"category": "external",
"summary": "2511337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511337"
},
{
"category": "external",
"summary": "2517538",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517538"
},
{
"category": "external",
"summary": "2519756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519756"
},
{
"category": "external",
"summary": "2519775",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519775"
},
{
"category": "external",
"summary": "2520949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520949"
},
{
"category": "external",
"summary": "2530661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530661"
},
{
"category": "external",
"summary": "2530998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530998"
},
{
"category": "external",
"summary": "2531003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531003"
},
{
"category": "external",
"summary": "2531007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531007"
},
{
"category": "external",
"summary": "2531577",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531577"
},
{
"category": "external",
"summary": "2531964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531964"
},
{
"category": "external",
"summary": "2532604",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532604"
},
{
"category": "external",
"summary": "2533566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533566"
},
{
"category": "external",
"summary": "2535096",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535096"
},
{
"category": "external",
"summary": "2535097",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535097"
},
{
"category": "external",
"summary": "2536895",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536895"
},
{
"category": "external",
"summary": "2536955",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536955"
},
{
"category": "external",
"summary": "2536961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536961"
},
{
"category": "external",
"summary": "2536962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536962"
},
{
"category": "external",
"summary": "2536970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536970"
},
{
"category": "external",
"summary": "JBEAP-34119",
"url": "https://issues.redhat.com/browse/JBEAP-34119"
},
{
"category": "external",
"summary": "JBEAP-34266",
"url": "https://issues.redhat.com/browse/JBEAP-34266"
},
{
"category": "external",
"summary": "JBEAP-34330",
"url": "https://issues.redhat.com/browse/JBEAP-34330"
},
{
"category": "external",
"summary": "JBEAP-34493",
"url": "https://issues.redhat.com/browse/JBEAP-34493"
},
{
"category": "external",
"summary": "JBEAP-34505",
"url": "https://issues.redhat.com/browse/JBEAP-34505"
},
{
"category": "external",
"summary": "JBEAP-34714",
"url": "https://issues.redhat.com/browse/JBEAP-34714"
},
{
"category": "external",
"summary": "JBEAP-34764",
"url": "https://issues.redhat.com/browse/JBEAP-34764"
},
{
"category": "external",
"summary": "JBEAP-34906",
"url": "https://issues.redhat.com/browse/JBEAP-34906"
},
{
"category": "external",
"summary": "JBEAP-34909",
"url": "https://issues.redhat.com/browse/JBEAP-34909"
},
{
"category": "external",
"summary": "JBEAP-34962",
"url": "https://issues.redhat.com/browse/JBEAP-34962"
},
{
"category": "external",
"summary": "JBEAP-35053",
"url": "https://issues.redhat.com/browse/JBEAP-35053"
},
{
"category": "external",
"summary": "JBEAP-35057",
"url": "https://issues.redhat.com/browse/JBEAP-35057"
},
{
"category": "external",
"summary": "JBEAP-35263",
"url": "https://issues.redhat.com/browse/JBEAP-35263"
},
{
"category": "external",
"summary": "JBEAP-35292",
"url": "https://issues.redhat.com/browse/JBEAP-35292"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95221.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 XP 6.0.7.GA release",
"tracking": {
"current_release_date": "2026-11-04T14:47:04+00:00",
"generator": {
"date": "2026-11-04T14:47:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:95221",
"initial_release_date": "2026-11-04T14:44:48+00:00",
"revision_history": [
{
"date": "2026-11-04T14:44:48+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-04T14:44:48+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-04T14:47:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 8.1",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 8.1",
"product_id": "Red Hat JBoss Enterprise Application Platform 8.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Leon Zlobecki"
]
}
],
"cve": "CVE-2026-17615",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2026-07-27T19:27:51.528000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2507635"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RESTEasy\u0027s SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "resteasy-core: RESTeasy SourceProvider remote unauthenticated file read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw allows unauthenticated remote file disclosure due to improper XML external entity (XXE) resolution in RESTEasy\u0027s SourceProvider. An attacker can exploit this by sending a crafted XML request to an exposed endpoint that processes `application/xml` and returns `Source` or `StreamSource` types, leading to the disclosure of sensitive server-side files. This affects applications utilizing RESTEasy where endpoints are configured to accept XML input and return `Source` or `StreamSource` objects, potentially exposing sensitive data on Red Hat supported products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-17615"
},
{
"category": "external",
"summary": "RHBZ#2507635",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507635"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-17615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-17615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-17615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17615"
}
],
"release_date": "2026-08-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid exposing RESTEasy endpoints that return Source or StreamSource types. Alternatively, implement a custom MessageBodyWriter for Source types that explicitly applies XML security features to the SAXParserFactory before parsing. Changes to application configuration or code typically require an application redeployment or restart to take effect.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "resteasy-core: RESTeasy SourceProvider remote unauthenticated file read"
},
{
"cve": "CVE-2026-59296",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences"
},
"discovery_date": "2026-08-21T10:50:55.231408+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520949"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Micrometer\u0027s StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary metrics, including critical system or business metrics, and the injection of false log entries, potentially impacting monitoring and auditing systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A moderate severity flaw was found in Micrometer\u0027s StatsD and Logging meter registries (io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core), which are shipped in a number of Red Hat middleware, integration, and application-platform products. These libraries do not sanitize newline characters (\\n, \\r) by default. When an application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values, a remote attacker can inject line terminators to break out of the current metric or log line. With the Datadog or Etsy flavor of the StatsD registry, whose protocol is newline-delimited, this enables line-protocol injection and cross-metric spoofing; with LoggingMeterRegistry, which prints metric output line-by-line to log files, this enables metric spoofing via downstream log-metrics scrapers or parsers as well as general log spoofing. A successful attacker can spoof arbitrary metrics, including critical system or business metrics, and inject false log entries, impacting the integrity of monitoring and auditing systems; the confidentiality and availability of the application itself are not directly affected. Exploitation requires the specific registry configuration together with unsafe instrumentation that passes untrusted input to meters, so attack complexity is high, and Red Hat rates this flaw Moderate (CVSS 3.1: 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N), consistent with the upstream MEDIUM rating.\n\nMultiple Red Hat products that ship the affected components, including Red Hat build of Quarkus, JBoss EAP XP, Red Hat Build of Keycloak, JBoss Data Grid, Red Hat AMQ, Red Hat OpenShift AI, and Red Hat build of Apache Camel, are recorded as affected, and fixes are being pursued by the responsible engineering teams; several affected product streams are out of active support scope. Red Hat Satellite is not affected because the vulnerable code is not present in the shipped candlepin component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59296"
},
{
"category": "external",
"summary": "RHBZ#2520949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59296"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59296",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59296"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-59296",
"url": "https://spring.io/security/cve-2026-59296"
}
],
"release_date": "2026-08-21T10:47:25.384000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing"
},
{
"cve": "CVE-2026-59903",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-08-17T18:11:22.687313+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517538"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. The `CorsHandler` component incorrectly replaces application `Vary` headers, such as `Authorization` or `Cookie`, with `Origin`. This allows a caching proxy or Content Delivery Network (CDN) to reuse authenticated responses across different users, leading to the disclosure of sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact information disclosure flaw in Netty arises from the `CorsHandler` incorrectly overwriting application `Vary` headers with `Origin`. This could allow caching proxies or CDNs to reuse authenticated responses across different users, potentially exposing sensitive data. Exploitation requires the presence of a caching proxy or CDN in front of the affected Netty application.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59903"
},
{
"category": "external",
"summary": "RHBZ#2517538",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517538"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59903"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59903",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59903"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17213",
"url": "https://github.com/netty/netty/pull/17213"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17217",
"url": "https://github.com/netty/netty/pull/17217"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46",
"url": "https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"
}
],
"release_date": "2026-08-17T17:56:28.726000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite"
},
{
"cve": "CVE-2026-59969",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-09-16T09:42:54.459543+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535097"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache ZooKeeper. When operating in FIPS (Federal Information Processing Standards) mode with specific Transport Layer Security (TLS) settings enabled, ZooKeeper\u0027s quorum communication fails to properly verify the hostname of peer certificates. This vulnerability allows a malicious actor, using a specially crafted or misissued certificate, to join the ZooKeeper cluster. Such an actor could then participate in critical operations like leader election and data replication, potentially leading to unauthorized access or disruption of the ZooKeeper service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache ZooKeeper when running in FIPS mode. The quorum TLS implementation fails to enforce peer hostname verification, allowing a malicious peer with a CA-trusted certificate (but mismatched SAN) to join quorum traffic, participate in leader election, and access replication flows. This vulnerability only affects deployments with FIPS mode enabled (zookeeper.fips-mode=true) and specific TLS quorum configurations (sslQuorum=true with hostname verification flags). This issue affects Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59969"
},
{
"category": "external",
"summary": "RHBZ#2535097",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535097"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59969"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59969",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59969"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss",
"url": "https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss"
}
],
"release_date": "2026-09-16T09:27:00.726000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Update to Apache ZooKeeper 3.8.7, 3.9.6, or later. As a workaround, disable FIPS mode if not required by compliance policies.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise"
},
{
"cve": "CVE-2026-66257",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T06:01:13.741100+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service (DoS). A denial of service attack makes the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache Qpid Proton-J, allowing a pre-authentication attacker to exhaust system resources through unbounded symbol value caching. This can lead to service unavailability in Red Hat products utilizing affected versions of Proton-J that expose a network endpoint. The vulnerability\u0027s impact is significant due to the potential for unauthenticated remote attackers to disrupt service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66257"
},
{
"category": "external",
"summary": "RHBZ#2511326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66257"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66257",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66257"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/dnczt6bgfcq2x6q8ljco177h1qmv59fm",
"url": "https://lists.apache.org/thread/dnczt6bgfcq2x6q8ljco177h1qmv59fm"
}
],
"release_date": "2026-08-05T05:18:01.606000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching"
},
{
"cve": "CVE-2026-66273",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T06:01:00.913036+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Apache Qpid Proton-J allows a remote, unauthenticated attacker to cause a denial of service. By sending specially crafted messages, an attacker can trigger excessive memory allocation, leading to resource exhaustion in applications utilizing the library within Red Hat products such as AMQ, Quarkus, Camel, and EAP.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66273"
},
{
"category": "external",
"summary": "RHBZ#2511322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66273"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66273",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66273"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/z34s9v5w05qk4qqtz5fs3v9wpxz6fnbh",
"url": "https://lists.apache.org/thread/z34s9v5w05qk4qqtz5fs3v9wpxz6fnbh"
}
],
"release_date": "2026-08-05T05:23:31.964000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation"
},
{
"cve": "CVE-2026-66274",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T07:00:53.637061+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important as a remote, unauthenticated attacker can trigger a denial of service in Apache Qpid Proton-J. By sending specially crafted messages with unbounded type nesting, an attacker can cause a StackOverflowError, leading to service unavailability without requiring prior authentication or complex attack prerequisites.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66274"
},
{
"category": "external",
"summary": "RHBZ#2511337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66274"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66274",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66274"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h",
"url": "https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h"
}
],
"release_date": "2026-08-05T05:29:44.681000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services utilizing Apache Qpid Proton-J to trusted clients and networks only. Implement firewall rules to limit inbound connections to the specific ports used by these services. This operational control reduces the attack surface by preventing untrusted external access, but may impact legitimate client connectivity if not carefully configured.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting"
},
{
"cve": "CVE-2026-68497",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-09-11T16:01:15.919616+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in jackson-databind allows remote attackers to consume excessive CPU by submitting specially crafted JSON with unbounded numeric values, causing a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68497"
},
{
"category": "external",
"summary": "RHBZ#2531964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68497"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd",
"url": "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/6127",
"url": "https://github.com/FasterXML/jackson-databind/pull/6127"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"
}
],
"release_date": "2026-09-11T15:49:30.366000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing"
},
{
"cve": "CVE-2026-84501",
"cwe": {
"id": "CWE-117",
"name": "Improper Output Neutralization for Logs"
},
"discovery_date": "2026-09-16T09:42:27.569541+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535096"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache ZooKeeper. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a specially crafted request containing newline characters. This vulnerability allows the attacker to forge complete log entries, including timestamps, log levels, and messages. These forged entries are visually indistinguishable from genuine ZooKeeper log output, which could lead to misinterpretation of system activity and hinder incident response efforts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "zookeeper: Apache ZooKeeper: Operational log forgery via newline injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache ZooKeeper. Operational log entries can be forged via newline injection in ensemble authentication requests, allowing unauthenticated attackers to inject arbitrary log records. This may obscure malicious activity or create false audit trails. This issue affects Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84501"
},
{
"category": "external",
"summary": "RHBZ#2535096",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535096"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84501"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84501",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84501"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33y",
"url": "https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33y"
}
],
"release_date": "2026-09-16T09:28:10.294000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Update to Apache ZooKeeper 3.8.7, 3.9.6, or later.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "zookeeper: Apache ZooKeeper: Operational log forgery via newline injection"
},
{
"cve": "CVE-2026-87795",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T10:21:04.988917+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530661"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the `ZstdDictCompress` constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of sensitive native heap memory and cause the Java Virtual Machine (JVM) to crash, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of an out-of-bounds read in zstd-jni caused by insufficient validation of offset and length values in the ZstdDictCompress constructor. An attacker who can influence these values may cause a JVM crash and potentially disclose native heap data. Affected Red Hat products are tracked through their existing remediation workflow.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87795"
},
{
"category": "external",
"summary": "RHBZ#2530661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530661"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87795"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87795",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87795"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb",
"url": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"url": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress"
}
],
"release_date": "2026-09-09T10:07:28.656000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Update com.github.luben/zstd-jni to version 1.5.7-14 or later. Until updated, do not pass attacker-controlled offset or length values to ZstdDictCompress.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service"
},
{
"cve": "CVE-2026-87824",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T14:51:05.674319+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530998"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. Attackers can exploit this by supplying oversized per-sample lengths to the `Zstd.trainFromBufferDirect` function, which fails to validate the samples buffer capacity. This allows for reading past buffer boundaries, leading to out-of-bounds memory access and ultimately causing the Java Virtual Machine (JVM) to terminate, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that CVE-2026-87824 affects Red Hat products that include the zstd-jni library in a vulnerable version. The vulnerability can allow a remote attacker to terminate the Java Virtual Machine by supplying crafted sample lengths to the dictionary-training function.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87824"
},
{
"category": "external",
"summary": "RHBZ#2530998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530998"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87824"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87824",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87824"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980",
"url": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853",
"url": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect"
}
],
"release_date": "2026-09-09T14:32:44.099000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "No complete workaround is currently available. As a temporary measure, applications using Zstd.trainFromBufferDirect() should validate that all sample lengths are non-negative and that their total does not exceed the capacity of the samples buffer before calling the function. Avoid passing attacker-controlled sample length arrays to this function until an update is available. Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect"
},
{
"cve": "CVE-2026-87825",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-09T14:52:13.405564+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531007"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This use-after-free vulnerability occurs because streams and contexts only hold a dictionary\u0027s shared lock during the load call, allowing the dictionary to be closed while still being referenced. A remote attacker could exploit this by closing a dictionary after associating it with a stream or context. Subsequent read or write operations would then access freed native memory, leading to silent data corruption or a Java Virtual Machine (JVM) crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in zstd-jni that could lead to silent data corruption or JVM crashes due to a use-after-free vulnerability. The flaw arises when a dictionary is prematurely closed while still actively referenced by compression or decompression streams, potentially impacting Red Hat products that utilize zstd-jni for data handling.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87825"
},
{
"category": "external",
"summary": "RHBZ#2531007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531007"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87825"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87825",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87825"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936",
"url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries"
}
],
"release_date": "2026-09-09T14:32:44.795000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability"
},
{
"cve": "CVE-2026-87877",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-09-09T14:51:43.444501+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. An attacker could exploit a use-after-free vulnerability by calling specific methods on closed streams without proper validation. This could lead to memory corruption, potentially allowing the attacker to corrupt unrelated objects or cause the Java Virtual Machine (JVM) to crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that CVE-2026-87877 affects Red Hat products that include the zstd-jni library in a vulnerable version. The vulnerability can allow memory corruption or denial of service when specific stream methods are called after the stream has been closed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87877"
},
{
"category": "external",
"summary": "RHBZ#2531003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87877"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87877",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87877"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e",
"url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"
}
],
"release_date": "2026-09-09T14:32:45.512000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "No complete workaround is currently available. As a temporary measure, applications using zstd-jni should not call setDict(), setLongMax(), setLevel(), or setRefMultipleDDicts() on a stream after close(). Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service"
},
{
"cve": "CVE-2026-89046",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-10T17:51:53.452234+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531577"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parser. This can lead to out-of-bounds memory reads, resulting in information disclosure or a Java Virtual Machine (JVM) crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of an out-of-bounds read in zstd-jni when a negative source position is supplied to Zstd.getFrameContentSize. This may disclose native memory or cause a JVM crash. Affected Red Hat products are tracked for updates containing zstd-jni 1.5.7-14 or later.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89046"
},
{
"category": "external",
"summary": "RHBZ#2531577",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531577"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89046"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89046",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89046"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646",
"url": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset"
}
],
"release_date": "2026-09-10T17:39:35.519000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Update to a product release containing zstd-jni 1.5.7-14 or later. Until updated, validate source positions and reject negative offsets before calling Zstd.getFrameContentSize. Do not pass attacker-controlled offsets to this method without validation.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read"
},
{
"acknowledgments": [
{
"names": [
"Yu Bao"
],
"organization": "PayPal Cyber Security Team"
}
],
"cve": "CVE-2026-89058",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-08-19T17:06:00.368000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519775"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RESTEasy\u0027s CorsFilter, which, when configured to allow all origins (\"*\"), reflects the request\u0027s Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim\u0027s session, resulting in a loss of confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89058"
},
{
"category": "external",
"summary": "RHBZ#2519775",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519775"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89058",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89058"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89058",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89058"
},
{
"category": "external",
"summary": "https://github.com/resteasy/resteasy/commit/efeb2b7",
"url": "https://github.com/resteasy/resteasy/commit/efeb2b7"
},
{
"category": "external",
"summary": "https://github.com/resteasy/resteasy/security/advisories/GHSA-972r-f3fv-whm3",
"url": "https://github.com/resteasy/resteasy/security/advisories/GHSA-972r-f3fv-whm3"
}
],
"release_date": "2026-09-17T14:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config"
},
{
"acknowledgments": [
{
"names": [
"Yu Bao"
],
"organization": "PayPal Cyber Security Team"
}
],
"cve": "CVE-2026-89059",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-08-19T16:21:31.345000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RESTEasy\u0027s IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an unauthenticated remote caller can trigger complete service disruption across affected Java virtual machines with minimal network traffic. While RESTEasy is widely integrated into Red Hat enterprise runtimes, exploitation is restricted to application endpoints explicitly configured to ingest image MIME types using the Java Image I/O provider. Deployments that do not expose REST endpoints binding IIOImage or handling arbitrary image uploads are not susceptible to this denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89059"
},
{
"category": "external",
"summary": "RHBZ#2519756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89059"
},
{
"category": "external",
"summary": "https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb",
"url": "https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb"
},
{
"category": "external",
"summary": "https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2",
"url": "https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2"
}
],
"release_date": "2026-09-17T14:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)"
},
{
"cve": "CVE-2026-90560",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-12T18:10:57.851894+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2532604"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading to memory being read beyond its allocated buffer. This could result in the termination of the Java Virtual Machine (JVM), causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that affected versions of zstd-jni are vulnerable to an out-of-bounds read in the ZstdDictDecompress constructor. An attacker who can cause an application to supply invalid dictionary offset or length values may terminate the Java Virtual Machine, resulting in denial of service. Red Hat is tracking fixes for affected products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90560"
},
{
"category": "external",
"summary": "RHBZ#2532604",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532604"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90560"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90560",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90560"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37",
"url": "https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f",
"url": "https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/issues/405",
"url": "https://github.com/luben/zstd-jni/issues/405"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress"
}
],
"release_date": "2026-09-12T18:06:43.794000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Until a fixed update is available, applications should validate that dictionary offset and length values are non-negative and that the requested range does not exceed the dictionary array. Apply product updates containing zstd-jni 1.5.7-14 or a Red Hat backport of the fix when available.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress"
},
{
"cve": "CVE-2026-90852",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-15T02:41:02.899732+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533566"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in luben zstd-jni. This flaw involves a use-after-free vulnerability in the ZstdCompressCtx.loadDict function, which handles dictionary sharing. A remote attacker could exploit this by manipulating dictionary sharing operations, potentially leading to denial of service, information disclosure, or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important remote use-after-free vulnerability in the `zstd-jni` library\u0027s dictionary sharing functionality. The flaw, affecting the `ZstdCompressCtx.loadDict` function, could allow an unauthenticated attacker to trigger a crash or potentially execute arbitrary code due to public exploit disclosure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90852"
},
{
"category": "external",
"summary": "RHBZ#2533566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533566"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90852"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/",
"url": "https://github.com/luben/zstd-jni/"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936",
"url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/issues/404",
"url": "https://github.com/luben/zstd-jni/issues/404"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://vuldb.com/cve/CVE-2026-90852",
"url": "https://vuldb.com/cve/CVE-2026-90852"
},
{
"category": "external",
"summary": "https://vuldb.com/submit/927022",
"url": "https://vuldb.com/submit/927022"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/403407",
"url": "https://vuldb.com/vuln/403407"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/403407/cti",
"url": "https://vuldb.com/vuln/403407/cti"
}
],
"release_date": "2026-09-15T02:15:10.581000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing"
},
{
"cve": "CVE-2026-93492",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:41:18+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536895"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate-impact flaw in Netty\u0027s HTTP/2 HpackEncoder allows a remote attacker to cause a Denial of Service. By sending specially crafted HTTP/2 SETTINGS frames with an oversized header table, an attacker can force the server to consume excessive CPU and memory resources, degrading service availability. This vulnerability affects applications utilizing Netty for HTTP/2 communication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93492"
},
{
"category": "external",
"summary": "RHBZ#2536895",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536895"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492"
}
],
"release_date": "2026-09-10T00:41:18+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size"
},
{
"cve": "CVE-2026-93567",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:48:08+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536955"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Netty\u0027s HTTP/1-to-HTTP/2 conversion can lead to an integrity loss in Red Hat products configured as HTTP/1-to-HTTP/2 proxies or gateways. A remote attacker can manipulate the Host header in an HTTP/1 CONNECT request, causing the HTTP/2 CONNECT request to use an attacker-controlled authority. This bypasses security controls such as tunnel allow-lists and egress policies, allowing connections to unintended upstream targets.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93567"
},
{
"category": "external",
"summary": "RHBZ#2536955",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536955"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567"
}
],
"release_date": "2026-09-10T00:48:08+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority"
},
{
"cve": "CVE-2026-93568",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:50:42+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536961"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty\u0027s HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw where Netty\u0027s HTTP/2 and HTTP/3 HTTP-object conversion paths incorrectly downgrade Extended CONNECT requests to standard HTTP/1.1 CONNECT requests. This can lead to authorization bypasses in Red Hat products acting as gateways, proxies, or application servers that utilize Netty\u0027s HTTP-object adapters, as critical protocol and path information is lost, preventing proper policy enforcement.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93568"
},
{
"category": "external",
"summary": "RHBZ#2536961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536961"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93568",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93568"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568"
}
],
"release_date": "2026-09-10T00:50:42+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests"
},
{
"cve": "CVE-2026-93569",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-09-10T00:51:06+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536962"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty\u0027s HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Netty-based HTTP/1 to HTTP/2 proxies or gateways allows an unauthenticated remote attacker to bypass security policies. The inconsistency in translating the HTTP/1 Host header to HTTP/2 :authority can lead to host or tenant security boundary bypasses, cache poisoning, or unintended request routing, despite initial security checks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93569"
},
{
"category": "external",
"summary": "RHBZ#2536962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536962"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93569"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569"
}
],
"release_date": "2026-09-10T00:51:06+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority"
},
{
"cve": "CVE-2026-93579",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:55:17+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536970"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP/2 implementation arises from disabled-by-default header value validation. When Netty-based applications act as HTTP/2 to HTTP/1.1 translation proxies or gateways, this can enable request smuggling or response splitting attacks by allowing prohibited control characters to be injected into HTTP/1.1 headers. Pure end-to-end HTTP/2 deployments are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93579"
},
{
"category": "external",
"summary": "RHBZ#2536970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536970"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579"
}
],
"release_date": "2026-09-10T00:55:17+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T14:44:48+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95221"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72 for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.