Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.15 security update

Fixed packages 5

Vulnerabilities 3

• Critical 9.6
  CVE-2025-12543

  Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

  A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malici…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Wolfi Maven
  Jan 7, 2026
• High 7.5
  CVE-2025-9784 Public exploit

  Undertow: undertow madeyoureset http/2 ddos vulnerability

  A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeate…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Wolfi Maven
  Sep 2, 2025
• Medium 5.9
  CVE-2025-23184

  Apache CXF: Denial of Service vulnerability with temporary files

  A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies …

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven
  Jan 21, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/7.1.0_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2339095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2392306
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2408784
• article
  https://issues.redhat.com/browse/JBEAP-31620
• article
  https://issues.redhat.com/browse/JBEAP-33273
• article
  https://issues.redhat.com/browse/JBEAP-33278
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33372.json
• report
  https://access.redhat.com/security/cve/CVE-2025-9784
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-9784
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-9784
• article
  https://github.com/undertow-io/undertow/pull/1778
• article
  https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final
• article
  https://issues.redhat.com/browse/UNDERTOW-2598
• article
  https://kb.cert.org/vuls/id/767506
• report
  https://access.redhat.com/security/cve/CVE-2025-12543
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-12543
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-12543
• report
  https://access.redhat.com/security/cve/CVE-2025-23184
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-23184
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-23184
• article
  https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122