Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate

Fixed packages 85

Vulnerabilities 41

• Critical 9.8
  CVE-2026-10579

  Picketlink-federation: auth bypass in picketlink saml unsolicited-response

  A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information dis…

  Red Hat Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
  Aug 11, 2026
• Critical 9.3
  CVE-2025-14813

  GOSTCTR implementation unable to process more than 255 blocks correctly

  : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects BC-JAVA: from 1.59 before 1.…

  Legion of the Bouncy Castle BC-JAVA logstash-9.3-iamguarded-compat logstash-9.3 Ubuntu Wolfi Maven
  Apr 15, 2026
• Critical 9.3
  CVE-2026-27446 EPSS 11%

  Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

  Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an at…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis wildfly-openjdk-21 Ubuntu Wolfi Maven
  Mar 4, 2026
• High 8.9
  CVE-2026-5598

  Non-constant time comparisons risk private key leakage in FrodoKEM.

  Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, fro…

  Legion of the Bouncy Castle BC-JAVA druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Apr 15, 2026
• High 8.8
  CVE-2026-15555

  Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

  A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8
  Aug 11, 2026
• High 8.7
  CVE-2026-3505

  Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

  Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.…

  Legion of the Bouncy Castle BC-JAVA apache-nifi bouncycastle Debian Ubuntu Wolfi Maven
  Apr 15, 2026
• High 8.7
  CVE-2026-45674 Public exploit

  Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 12, 2026
• High 8.7
  CVE-2026-47691

  Netty has Insufficient Bailiwick Validation for NS Records

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An atta…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 12, 2026
• High 8.7
  CVE-2026-48006

  Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes…

  netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 12, 2026
• High 8.7
  CVE-2026-48059

  Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a synt…

  netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 12, 2026
• High 8.7
  CVE-2026-68494

  jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

  The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into …

  FasterXML jackson-core druid trino Ubuntu Wolfi Maven
  Aug 4, 2026
• High 8.2
  CVE-2026-101292

  Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization

  Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol…

  Red Hat Red Hat AMQ Broker 7 Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat JBoss Enterprise Application Platform 7.4.25
  Sep 28, 2026
• High 8.1
  CVE-2026-15556

  Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions

  A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8
  Aug 11, 2026
• High 8.1
  CVE-2026-15560

  Openjdk-orb: unauthed class loading via iiop in eap

  when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 8.1 Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
  Aug 11, 2026
• High 8.1
  CVE-2026-44249

  Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

  Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.c…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 11, 2026
• High 8.1
  CVE-2026-54512 Public exploit

  jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…

  FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 23, 2026
• High 7.5
  CVE-2026-15561

  Undertow-core: oom via missing limits in chunked trailer in eap's undertow

  A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achievi…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Debian Ubuntu
  Aug 11, 2026
• High 7.5
  CVE-2026-15562

  Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service

  A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
  Aug 11, 2026
• High 7.5
  CVE-2026-15565

  Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method

  A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu
  Aug 11, 2026
• High 7.5
  CVE-2026-15567

  Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

  A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7
  Aug 11, 2026
• High 7.5
  CVE-2026-42579

  Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface:…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  May 13, 2026
• High 7.5
  CVE-2026-42587

  Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is c…

  netty io.netty netty netty-codec-http Debian Wolfi Maven
  May 13, 2026
• High 7.5
  CVE-2026-44250

  Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

  Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This force…

  netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 11, 2026
• High 7.5
  CVE-2026-44890

  Netty has Unbounded Direct Memory Consumption in its RedisDecoder

  Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\…

  netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 11, 2026
• High 7.5
  CVE-2026-44893

  Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

  Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice…

  netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 12, 2026
• High 7.5
  CVE-2026-45416

  Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the firs…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 12, 2026
• High 7.5
  CVE-2026-46340

  Netty: SCTP reassembly nests buffers without bound

  Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpoole…

  netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 12, 2026
• High 7.5
  CVE-2026-46581

  In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or…

  Eclipse Foundation Eclipse Mojarra
  Aug 5, 2026
• High 7.5
  CVE-2026-50010

  Netty's wrapping plain trust manager silently disables hostname verification

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 12, 2026
• High 7.5
  CVE-2026-50011 Public exploit

  Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

  Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an…

  netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 12, 2026
• High 7.4
  CVE-2026-15554

  Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery

  the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a fo…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Debian Ubuntu
  Aug 11, 2026
• High 7.4
  CVE-2026-15563

  Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos

  A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat Fuse 7
  Aug 11, 2026
• High 7.3
  CVE-2026-42584

  Netty: HttpClientCodec response desynchronization

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines G…

  netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  May 13, 2026
• Medium 6.5
  CVE-2026-42585

  Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Fi…

  netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  May 13, 2026
• Medium 6.3
  CVE-2026-50193

  jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply…

  FasterXML jackson-databind druid celeborn-0.6 Debian Ubuntu Wolfi Maven
  Jun 23, 2026
• Medium 6.3
  CVE-2026-5588

  PKIX draft CompositeVerifier accepts empty signature sequence as valid.

  Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpk…

  Legion of the Bouncy Castle BC-JAVA BCPKIX-FIPS BCPIX-LTS Debian Ubuntu Wolfi Maven
  Apr 15, 2026
• Medium 5.8
  CVE-2026-42581

  Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  May 13, 2026
• Medium 5.5
  CVE-2026-0636

  LDAP Injection Vulnerability in LDAPStoreHelper.java

  Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affect…

  Legion of the Bouncy Castle BC-JAVA druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Apr 15, 2026
• Medium 5.3
  CVE-2026-41417

  Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()

  Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, b…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  May 6, 2026
• Medium 5.3
  CVE-2026-48043

  netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

  Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a p…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 12, 2026
• Low 2.9
  CVE-2026-42578

  Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  May 13, 2026

References

• article
  https://access.redhat.com/errata/RHSA-2026:53644
• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2444320
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458635
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458638
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458640
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458641
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467540
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477217
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477220
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477224
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477226
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477227
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477232
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480325
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480637
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482963
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482965
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483121
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483131
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483133
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483135
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483136
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483138
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488053
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488062
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488081
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488388
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488391
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488400
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488413
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488429
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488433
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488437
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488439