Skip to content
OpenAdvisories
High RHSA-2026:49700 11 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7 security update

Published Aug 4, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 67

ReleasePackageFixed in
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-eap-product-conf-parent 0:801.7.1-1.GA_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-eap-product-conf-wildfly-ee-feature-pack 0:801.7.1-1.GA_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-buffer 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-codec 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-codec-dns 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-codec-http 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-codec-socks 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-common 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-handler 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-handler-proxy 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-resolver 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-resolver-dns 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-transport 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-transport-classes-epoll 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-transport-native-epoll 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-transport-native-epoll-debuginfo 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-netty-transport-native-unix-common 0:4.1.135-1.Final_redhat_00001.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-wildfly 0:8.1.7.1-1.GA_redhat_00004.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-wildfly-java-jdk21 0:8.1.7.1-1.GA_redhat_00004.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el10 eap8-wildfly-modules 0:8.1.7.1-1.GA_redhat_00004.1.el10eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-eap-product-conf-parent 0:801.7.1-1.GA_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-eap-product-conf-wildfly-ee-feature-pack 0:801.7.1-1.GA_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-jose4j 0:0.9.6-2.redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-buffer 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-codec 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-codec-dns 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-codec-http 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-codec-socks 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-common 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-handler 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-handler-proxy 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-resolver 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-resolver-dns 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-transport 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-transport-classes-epoll 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-transport-native-epoll 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-transport-native-epoll-debuginfo 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-transport-native-unix-common 0:4.1.135-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-wildfly 0:8.1.7.1-1.GA_redhat_00004.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-wildfly-java-jdk17 0:8.1.7.1-1.GA_redhat_00004.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-wildfly-java-jdk21 0:8.1.7.1-1.GA_redhat_00004.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-wildfly-modules 0:8.1.7.1-1.GA_redhat_00004.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-eap-product-conf-parent 0:801.7.1-1.GA_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-eap-product-conf-wildfly-ee-feature-pack 0:801.7.1-1.GA_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-jose4j 0:0.9.6-2.redhat_00002.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-buffer 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-codec 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-codec-dns 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-codec-http 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-codec-socks 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-common 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-handler 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-handler-proxy 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-resolver 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-resolver-dns 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-transport 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-transport-classes-epoll 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-transport-native-epoll 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-transport-native-epoll-debuginfo 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-netty-transport-native-unix-common 0:4.1.135-1.Final_redhat_00001.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly 0:8.1.7.1-1.GA_redhat_00004.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-java-jdk17 0:8.1.7.1-1.GA_redhat_00004.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-java-jdk21 0:8.1.7.1-1.GA_redhat_00004.1.el9eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el9 eap8-wildfly-modules 0:8.1.7.1-1.GA_redhat_00004.1.el9eap

Vulnerabilities 11

  • High 8.7
    CVE-2026-45674 Public exploit

    Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2026-47691

    Netty has Insufficient Bailiwick Validation for NS Records

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An atta…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.1
    CVE-2026-44249

    Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

    Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.c…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-42579

    Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface:…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-42587

    Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is c…

    netty io.netty netty netty-codec-http Debian Wolfi Maven
  • High 7.5
    CVE-2026-45416

    Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the firs…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-50010

    Netty's wrapping plain trust manager silently disables hostname verification

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.3
    CVE-2026-42584

    Netty: HttpClientCodec response desynchronization

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines G…

    netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2026-42585

    Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Fi…

    netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  • Medium 5.8
    CVE-2026-42581

    Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Low 2.9
    CVE-2026-42578

    Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index
  • article
    https://access.redhat.com/articles/7145683
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2488081
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2488391
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2488400
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2488429
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2488439
  • article
    https://issues.redhat.com/browse/JBEAP-33514
  • article
    https://issues.redhat.com/browse/JBEAP-33903
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49700.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-42578
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477226
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42578
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42578
  • article
    https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr
  • report
    https://access.redhat.com/security/cve/CVE-2026-42579
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477217
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42579
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42579
  • article
    https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm
  • report
    https://access.redhat.com/security/cve/CVE-2026-42581
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477232
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42581
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42581
  • article
    https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9
  • report
    https://access.redhat.com/security/cve/CVE-2026-42584
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477224
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42584
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42584
  • article
    https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3
  • report
    https://access.redhat.com/security/cve/CVE-2026-42585
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477227
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42585
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42585
  • article
    https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv
  • report
    https://access.redhat.com/security/cve/CVE-2026-42587
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477220