Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update

Fixed packages 44

Vulnerabilities 4

• High 8.7
  CVE-2026-28367

  Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

  A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Clou…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Maven
  Mar 27, 2026
• High 8.7
  CVE-2026-28368

  Undertow: undertow: request smuggling via inconsistent header parsing

  A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Maven
  Mar 27, 2026
• High 8.7
  CVE-2026-28369

  Undertow: undertow: request smuggling via malformed http request headers

  A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be explo…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Maven
  Mar 27, 2026
• High 7.5
  CVE-2026-1605

  The Eclipse Jetty Server Artifact has a Gzip request memory leak

  In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inf…

  Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven
  Mar 5, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index
• article
  https://access.redhat.com/articles/7137768
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2443260
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2443261
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2443262
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2444815
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25125.json
• report
  https://access.redhat.com/security/cve/CVE-2026-1605
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-1605
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-1605
• article
  https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f
• report
  https://access.redhat.com/security/cve/CVE-2026-28367
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-28367
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-28367
• report
  https://access.redhat.com/security/cve/CVE-2026-28368
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-28368
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-28368
• report
  https://access.redhat.com/security/cve/CVE-2026-28369
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-28369
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-28369