Fixed packages 85
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-cli | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-commons | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-core-client | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-dto | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-hornetq-protocol | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-hqclient-protocol | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-jakarta-client | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-jakarta-ra | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-jakarta-server | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-jakarta-service-extensions | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-jdbc-store | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-journal | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-selector | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-activemq-artemis-server | 0:2.40.0-6.redhat_00012.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-angus | 0:2.0.5-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-angus-activation | 0:2.0.3-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-angus-mail | 0:2.0.5-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-bouncycastle | 0:1.84.0-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-bouncycastle-jmail | 0:1.84.0-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-bouncycastle-pg | 0:1.84.0-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-bouncycastle-pkix | 0:1.84.0-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-bouncycastle-prov | 0:1.84.0-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-bouncycastle-util | 0:1.84.0-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-eap-product-conf-parent | 0:801.6.0-1.GA_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-eap-product-conf-wildfly-ee-feature-pack | 0:801.6.0-1.GA_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-guava | 0:33.0.0-3.jre_redhat_00004.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-guava-failureaccess | 0:1.0.3-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-guava-libraries | 0:33.0.0-3.jre_redhat_00004.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-hal-console | 0:3.7.19-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-hibernate | 0:6.6.48-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-hibernate-core | 0:6.6.48-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-hibernate-envers | 0:6.6.48-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-hibernate-search | 0:7.2.6-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-hibernate-search-backend-elasticsearch | 0:7.2.6-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-hibernate-search-backend-lucene | 0:7.2.6-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-hibernate-search-engine | 0:7.2.6-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-hibernate-search-mapper-orm | 0:7.2.6-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-hibernate-search-mapper-pojo-base | 0:7.2.6-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-hibernate-search-util-common | 0:7.2.6-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-jakarta-activation | 0:2.1.4-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-jboss-logging | 0:3.6.2-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-jboss-metadata | 0:16.1.0-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-jboss-metadata-appclient | 0:16.1.0-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-jboss-metadata-common | 0:16.1.0-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-jboss-metadata-ear | 0:16.1.0-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-jboss-metadata-ejb | 0:16.1.0-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-jboss-metadata-web | 0:16.1.0-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-jctools | 0:4.0.6-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-jctools-core | 0:4.0.6-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-buffer | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-codec | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-codec-dns | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-codec-http | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-codec-socks | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-common | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-handler | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-handler-proxy | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-resolver | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-resolver-dns | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-transport | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-transport-classes-epoll | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-transport-native-epoll | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-transport-native-epoll-debuginfo | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-netty-transport-native-unix-common | 0:4.1.132-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-plexus-utils | 0:3.6.1-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-reactivex-rxjava | 0:3.1.12-1.redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-reactivex-rxjava2 | 0:2.2.21-5.redhat_00003.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly | 0:8.1.6-5.GA_redhat_00007.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-client-config | 0:1.0.1-4.Final_redhat_00002.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-http-client | 0:2.1.4-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-http-client-common | 0:2.1.4-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-http-ejb-client | 0:2.1.4-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-http-naming-client | 0:2.1.4-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-http-transaction-client | 0:2.1.4-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-java-jdk17 | 0:8.1.6-5.GA_redhat_00007.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-java-jdk21 | 0:8.1.6-5.GA_redhat_00007.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-javadocs | 0:8.1.1-10.GA_redhat_00017.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-modules | 0:8.1.6-5.GA_redhat_00007.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-openssl | 0:2.3.0-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-openssl-el8-x86_64 | 0:2.3.0-1.Final.redhat.00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-openssl-el8-x86_64-debuginfo | 0:2.3.0-1.Final.redhat.00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-wildfly-openssl-java | 0:2.3.0-1.Final_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 | eap8-yasson | 0:3.0.4-5.redhat_00007.1.el8eap |
Vulnerabilities 14
-
Critical 9.3
GOSTCTR implementation unable to process more than 255 blocks correctly
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects BC-JAVA: from 1.59 before 1.…
-
Critical 9.3CVE-2026-27446 EPSS 11%
Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an at…
-
High 8.9
mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running appl…
-
High 8.9
c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property
c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` whi…
-
High 8.9
Non-constant time comparisons risk private key leakage in FrodoKEM.
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, fro…
-
High 8.8
Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
-
High 8.7
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed…
-
High 8.7CVE-2026-33871 Public exploit
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The serve…
-
High 8.7
Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.…
-
High 8.1
Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli
A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
-
High 7.5
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g.…
-
High 7.5
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Vers…
-
Medium 6.3
PKIX draft CompositeVerifier accepts empty signature sequence as valid.
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpk…
-
Medium 5.5
LDAP Injection Vulnerability in LDAPStoreHelper.java
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affect…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
article
https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
-
article
https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index
-
article
https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/red_hat_jboss_enterprise_application_platform_installation_methods/index
-
article
https://access.redhat.com/articles/7134190
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2337621
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2441268
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2442671
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2442908
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2442922
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2444320
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2451409
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2452453
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2452456
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458634
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458635
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458638
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458640
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458641
-
article
https://issues.redhat.com/browse/JBEAP-29032
-
article
https://issues.redhat.com/browse/JBEAP-31314
-
article
https://issues.redhat.com/browse/JBEAP-31468
-
article
https://issues.redhat.com/browse/JBEAP-31868
-
article
https://issues.redhat.com/browse/JBEAP-31874
-
article
https://issues.redhat.com/browse/JBEAP-32025
-
article
https://issues.redhat.com/browse/JBEAP-32028
-
article
https://issues.redhat.com/browse/JBEAP-32064
-
article
https://issues.redhat.com/browse/JBEAP-32074
-
article
https://issues.redhat.com/browse/JBEAP-32078
-
article
https://issues.redhat.com/browse/JBEAP-32084
-
article
https://issues.redhat.com/browse/JBEAP-32123
-
article
https://issues.redhat.com/browse/JBEAP-32209
-
article
https://issues.redhat.com/browse/JBEAP-32212
-
article
https://issues.redhat.com/browse/JBEAP-32266
-
article
https://issues.redhat.com/browse/JBEAP-32293
-
article
https://issues.redhat.com/browse/JBEAP-32295
-
article
https://issues.redhat.com/browse/JBEAP-32339
-
article
https://issues.redhat.com/browse/JBEAP-32350
-
article
https://issues.redhat.com/browse/JBEAP-32415