Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.17 security update

Fixed packages 17

Vulnerabilities 4

• Critical 9.8
  CVE-2025-48913

  Apache CXF: Untrusted JMS configuration can lead to RCE

  If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are re…

  Apache Software Foundation Apache CXF wildfly-openjdk-21 wildfly-openjdk-17 Wolfi Maven
  Aug 8, 2025
• High 8.3
  CVE-2026-0603 Public exploit

  Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

  A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. T…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat OpenShift AI (RHOAI) Red Hat Data Grid 8 Maven
  Jan 23, 2026
• High 7.5
  CVE-2024-3884

  Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

  A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will caus…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Wolfi Maven
  Dec 3, 2025
• Medium 6.8
  CVE-2025-4949

  XXE vulnerability in Eclipse JGit

  In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are v…

  Eclipse JGit Eclipse JGit thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 21, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html/7.3.0_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275287
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2367730
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2387221
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2427147
• article
  https://issues.redhat.com/browse/JBEAP-31431
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6011.json
• report
  https://access.redhat.com/security/cve/CVE-2024-3884
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3884
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3884
• report
  https://access.redhat.com/security/cve/CVE-2025-4949
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-4949
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-4949
• article
  https://gitlab.eclipse.org/security/cve-assignement/-/issues/64
• article
  https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281
• article
  https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1
• report
  https://access.redhat.com/security/cve/CVE-2025-48913
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-48913
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-48913
• article
  https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83
• report
  https://access.redhat.com/security/cve/CVE-2026-0603
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0603
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0603