Fixed packages 46
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-apache-cxf | 0:4.0.10-1.redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-apache-cxf-rt | 0:4.0.10-1.redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-apache-cxf-services | 0:4.0.10-1.redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-apache-cxf-tools | 0:4.0.10-1.redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-bouncycastle | 0:1.82.0-1.redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-bouncycastle-jmail | 0:1.82.0-1.redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-bouncycastle-pg | 0:1.82.0-1.redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-bouncycastle-pkix | 0:1.82.0-1.redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-bouncycastle-prov | 0:1.82.0-1.redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-bouncycastle-util | 0:1.82.0-1.redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-eap-product-conf-parent | 0:801.3.0-1.GA_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-eap-product-conf-wildfly-ee-feature-pack | 0:801.3.0-1.GA_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-eventstream | 0:1.0.1-3.redhat_00003.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-hibernate | 0:6.6.36-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-hibernate-core | 0:6.6.36-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-hibernate-envers | 0:6.6.36-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-jboss-el-api_5.0_spec | 0:4.0.2-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-jboss-threads | 0:2.5.0-1.redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-undertow | 0:2.3.20-2.SP4_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly | 0:8.1.3-4.GA_redhat_00006.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-cache-infinispan-common | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-cache-infinispan-embedded | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-cache-infinispan-remote | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-cache-spi | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-context | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-marshalling-jboss | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-marshalling-protostream | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-marshalling-spi | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-server-api | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-server-infinispan | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-server-jgroups | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-server-local | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-server-spi | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-session-cache | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-session-infinispan-embedded | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-session-infinispan-remote | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-session-spec-servlet-6.0 | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-session-spec-spi | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-clustering-session-spi | 0:5.0.12-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-elytron | 0:2.6.6-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-elytron-tool | 0:2.6.6-1.Final_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-java-jdk17 | 0:8.1.3-4.GA_redhat_00006.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-java-jdk21 | 0:8.1.3-4.GA_redhat_00006.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-javadocs | 0:8.1.1-4.GA_redhat_00007.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 | eap8-wildfly-modules | 0:8.1.3-4.GA_redhat_00006.1.el9eap |
Vulnerabilities 3
-
Critical 9.6
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malici…
-
High 7.5
Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will caus…
-
High 7.5CVE-2025-9784 Public exploit
Undertow: undertow madeyoureset http/2 ddos vulnerability
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeate…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
article
https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
-
article
https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index
-
article
https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/red_hat_jboss_enterprise_application_platform_installation_methods/index
-
article
https://access.redhat.com/articles/7134190
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275287
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2392306
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2408784
-
article
https://issues.redhat.com/browse/JBEAP-30596
-
article
https://issues.redhat.com/browse/JBEAP-31250
-
article
https://issues.redhat.com/browse/JBEAP-31326
-
article
https://issues.redhat.com/browse/JBEAP-31344
-
article
https://issues.redhat.com/browse/JBEAP-31345
-
article
https://issues.redhat.com/browse/JBEAP-31374
-
article
https://issues.redhat.com/browse/JBEAP-31380
-
article
https://issues.redhat.com/browse/JBEAP-31389
-
article
https://issues.redhat.com/browse/JBEAP-31396
-
article
https://issues.redhat.com/browse/JBEAP-31414
-
article
https://issues.redhat.com/browse/JBEAP-31421
-
article
https://issues.redhat.com/browse/JBEAP-31474
-
article
https://issues.redhat.com/browse/JBEAP-31494
-
article
https://issues.redhat.com/browse/JBEAP-31495
-
article
https://issues.redhat.com/browse/JBEAP-31601
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0384.json
-
report
https://access.redhat.com/security/cve/CVE-2024-3884
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-3884
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-3884
-
report
https://access.redhat.com/security/cve/CVE-2025-9784
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-9784
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-9784
-
article
https://github.com/undertow-io/undertow/pull/1778
-
article
https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final
-
article
https://issues.redhat.com/browse/UNDERTOW-2598
-
article
https://kb.cert.org/vuls/id/767506
-
report
https://access.redhat.com/security/cve/CVE-2025-12543
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-12543
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-12543