Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.14 security update

Fixed packages 14

Vulnerabilities 3

• Critical 9.8
  CVE-2025-48913

  Apache CXF: Untrusted JMS configuration can lead to RCE

  If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are re…

  Apache Software Foundation Apache CXF wildfly-openjdk-21 wildfly-openjdk-17 Wolfi Maven
  Aug 8, 2025
• High 8.3
  CVE-2026-0603 Public exploit

  Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

  A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. T…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat OpenShift AI (RHOAI) Red Hat Data Grid 8 Maven
  Jan 23, 2026
• High 7.5
  CVE-2024-3884

  Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

  A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will caus…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Wolfi Maven
  Dec 3, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/7.1.0_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275287
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2387221
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2427147
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6012.json
• report
  https://access.redhat.com/security/cve/CVE-2024-3884
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3884
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3884
• report
  https://access.redhat.com/security/cve/CVE-2025-48913
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-48913
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-48913
• article
  https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83
• report
  https://access.redhat.com/security/cve/CVE-2026-0603
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0603
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0603