Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.16 security update

Fixed packages 41

Vulnerabilities 3

• High 8.7
  CVE-2025-52999 Public exploit

  jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data

  jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a Stackov…

  FasterXML jackson-core druid tez Debian Ubuntu Wolfi Maven
  Jun 25, 2025
• High 8.2
  CVE-2025-55163 Public exploit

  Netty MadeYouReset HTTP/2 DDoS Vulnerability

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames …

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Aug 13, 2025
• High 7.5
  CVE-2024-7885

  Undertow: improper state management in proxy protocol parsing causes information leakage

  A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a res…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Maven
  Aug 21, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2305290
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2374804
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2388252
• article
  https://issues.redhat.com/browse/JBEAP-30792
• article
  https://issues.redhat.com/browse/JBEAP-31038
• article
  https://issues.redhat.com/browse/JBEAP-31348
• article
  https://issues.redhat.com/browse/JBEAP-31350
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0743.json
• report
  https://access.redhat.com/security/cve/CVE-2024-7885
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-7885
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-7885
• report
  https://access.redhat.com/security/cve/CVE-2025-52999
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-52999
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-52999
• article
  https://github.com/FasterXML/jackson-core/pull/943
• article
  https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3
• report
  https://access.redhat.com/security/cve/CVE-2025-55163
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-55163
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-55163
• article
  https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4
• article
  https://kb.cert.org/vuls/id/767506