Skip to content
OpenAdvisories
Critical RHSA-2026:18055 14 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update

Published May 19, 2026 · Updated Oct 20, 2026

Fixed packages 85

ReleasePackageFixed in
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-cli 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-commons 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-core-client 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-dto 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-hornetq-protocol 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-hqclient-protocol 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-jakarta-client 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-jakarta-ra 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-jakarta-server 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-jakarta-service-extensions 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-jdbc-store 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-journal 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-selector 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-activemq-artemis-server 0:2.40.0-6.redhat_00012.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-angus 0:2.0.5-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-angus-activation 0:2.0.3-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-angus-mail 0:2.0.5-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-bouncycastle 0:1.84.0-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-bouncycastle-jmail 0:1.84.0-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-bouncycastle-pg 0:1.84.0-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-bouncycastle-pkix 0:1.84.0-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-bouncycastle-prov 0:1.84.0-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-bouncycastle-util 0:1.84.0-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-eap-product-conf-parent 0:801.6.0-1.GA_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-eap-product-conf-wildfly-ee-feature-pack 0:801.6.0-1.GA_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-guava 0:33.0.0-3.jre_redhat_00004.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-guava-failureaccess 0:1.0.3-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-guava-libraries 0:33.0.0-3.jre_redhat_00004.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-hal-console 0:3.7.19-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-hibernate 0:6.6.48-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-hibernate-core 0:6.6.48-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-hibernate-envers 0:6.6.48-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-hibernate-search 0:7.2.6-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-hibernate-search-backend-elasticsearch 0:7.2.6-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-hibernate-search-backend-lucene 0:7.2.6-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-hibernate-search-engine 0:7.2.6-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-hibernate-search-mapper-orm 0:7.2.6-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-hibernate-search-mapper-pojo-base 0:7.2.6-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-hibernate-search-util-common 0:7.2.6-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-jakarta-activation 0:2.1.4-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-jboss-logging 0:3.6.2-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-jboss-metadata 0:16.1.0-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-jboss-metadata-appclient 0:16.1.0-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-jboss-metadata-common 0:16.1.0-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-jboss-metadata-ear 0:16.1.0-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-jboss-metadata-ejb 0:16.1.0-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-jboss-metadata-web 0:16.1.0-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-jctools 0:4.0.6-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-jctools-core 0:4.0.6-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-buffer 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-codec 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-codec-dns 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-codec-http 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-codec-socks 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-common 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-handler 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-handler-proxy 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-resolver 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-resolver-dns 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-transport 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-transport-classes-epoll 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-transport-native-epoll 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-transport-native-epoll-debuginfo 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-transport-native-unix-common 0:4.1.132-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-plexus-utils 0:3.6.1-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-reactivex-rxjava 0:3.1.12-1.redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-reactivex-rxjava2 0:2.2.21-5.redhat_00003.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly 0:8.1.6-5.GA_redhat_00007.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-client-config 0:1.0.1-4.Final_redhat_00002.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-http-client 0:2.1.4-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-http-client-common 0:2.1.4-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-http-ejb-client 0:2.1.4-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-http-naming-client 0:2.1.4-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-http-transaction-client 0:2.1.4-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-java-jdk17 0:8.1.6-5.GA_redhat_00007.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-java-jdk21 0:8.1.6-5.GA_redhat_00007.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-javadocs 0:8.1.1-10.GA_redhat_00017.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-modules 0:8.1.6-5.GA_redhat_00007.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-openssl 0:2.3.0-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-openssl-el9-x86_64 0:2.3.0-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-openssl-el9-x86_64-debuginfo 0:2.3.0-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-openssl-java 0:2.3.0-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-yasson 0:3.0.4-5.redhat_00007.1.el9eap

Vulnerabilities 14

  • Critical 9.3

    GOSTCTR implementation unable to process more than 255 blocks correctly

    : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects BC-JAVA: from 1.59 before 1.…

  • Critical 9.3
    CVE-2026-27446 EPSS 11%

    Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

    Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an at…

  • High 8.9

    mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

    mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running appl…

  • High 8.9

    c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

    c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` whi…

  • High 8.9

    Non-constant time comparisons risk private key leakage in FrodoKEM.

    Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, fro…

  • High 8.8

    Plexus-Utils has a Directory Traversal vulnerability in its extractFile method

    Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

  • High 8.7

    minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed…

  • High 8.7
    CVE-2026-33871 Public exploit

    Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The serve…

  • High 8.7

    Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

    Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.…

  • High 8.1

    Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

    A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

  • High 7.5

    minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g.…

  • High 7.5

    Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Vers…

  • Medium 6.3

    PKIX draft CompositeVerifier accepts empty signature sequence as valid.

    Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpk…

  • Medium 5.5

    LDAP Injection Vulnerability in LDAPStoreHelper.java

    Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affect…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/red_hat_jboss_enterprise_application_platform_installation_methods/index
  • article
    https://access.redhat.com/articles/7134190
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2337621
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2441268
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442671
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442908
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2442922
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2444320
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2451409
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2452453
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2452456
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458634
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458635
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458638
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458640
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458641
  • article
    https://issues.redhat.com/browse/JBEAP-29032
  • article
    https://issues.redhat.com/browse/JBEAP-31314
  • article
    https://issues.redhat.com/browse/JBEAP-31468
  • article
    https://issues.redhat.com/browse/JBEAP-31868
  • article
    https://issues.redhat.com/browse/JBEAP-31874
  • article
    https://issues.redhat.com/browse/JBEAP-32025
  • article
    https://issues.redhat.com/browse/JBEAP-32028
  • article
    https://issues.redhat.com/browse/JBEAP-32064
  • article
    https://issues.redhat.com/browse/JBEAP-32075
  • article
    https://issues.redhat.com/browse/JBEAP-32078
  • article
    https://issues.redhat.com/browse/JBEAP-32084
  • article
    https://issues.redhat.com/browse/JBEAP-32123
  • article
    https://issues.redhat.com/browse/JBEAP-32209
  • article
    https://issues.redhat.com/browse/JBEAP-32212
  • article
    https://issues.redhat.com/browse/JBEAP-32266
  • article
    https://issues.redhat.com/browse/JBEAP-32293
  • article
    https://issues.redhat.com/browse/JBEAP-32295
  • article
    https://issues.redhat.com/browse/JBEAP-32339
  • article
    https://issues.redhat.com/browse/JBEAP-32350
  • article
    https://issues.redhat.com/browse/JBEAP-32415