Known vulnerabilities in Red Hat JBoss Enterprise Application Platform 8

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-93491	Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue	7.5 High	Sep 18, 2026
CVE-2026-93488	Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams	7.5 High	Sep 18, 2026
CVE-2026-89058	Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config	7.4 High	Sep 18, 2026
CVE-2026-89059	Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)	7.5 High	Sep 18, 2026
CVE-2026-81829	A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed…	5.3 Medium	Sep 17, 2026
CVE-2026-86404	EAP's Artemis deserialization configuration permits deserialization by default	8.8 High	Sep 7, 2026
CVE-2026-17615	Resteasy-core: resteasy sourceprovider remote unauthenticated file read	7.5 High	Aug 31, 2026
CVE-2026-81624	Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite	7.5 High	Aug 31, 2026
CVE-2026-5680	Undertow-core: undertow: denial of service via websocket permessage-deflate processing	7.5 High	Aug 27, 2026
CVE-2026-19611	Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding	7.4 High	Aug 20, 2026
CVE-2026-76166	A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module)	4.3 Medium	Aug 19, 2026
CVE-2026-19879	Io.undertow/undertow: undertow: http response header integrity issue due to character truncation	5.3 Medium	Aug 14, 2026
CVE-2026-14180	Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap	5.3 Medium	Aug 11, 2026
CVE-2026-15567	A flaw was found in Wildfly	7.5 High	Aug 11, 2026
CVE-2026-15565	A flaw was found in Undertow	7.5 High	Aug 11, 2026
CVE-2026-15563	A flaw was found in EAP's IIOP	7.4 High	Aug 11, 2026
CVE-2026-15562	Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service	7.5 High	Aug 11, 2026
CVE-2026-15561	A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder	7.5 High	Aug 11, 2026
CVE-2026-15560	Openjdk-orb: unauthed class loading via iiop in eap	8.1 High	Aug 11, 2026
CVE-2026-15556	A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching…	8.1 High	Aug 11, 2026
CVE-2026-15554	the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret…	7.4 High	Aug 11, 2026
CVE-2026-15555	A flaw was found in JBoss marshalling	8.8 High	Aug 11, 2026
CVE-2026-10579	A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no…	9.8 Critical	Aug 11, 2026
CVE-2026-24329	Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.	4.9 Medium	Aug 11, 2026
CVE-2026-24330	Wildfly-core: wildfly: arbitrary file read via malicious archive deployment	6.5 Medium	Aug 11, 2026

Other Red Hat products