Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security update

Fixed packages 95

Vulnerabilities 5

• Critical 9.8
  CVE-2026-57967 Public exploit

  Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

  An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache Activ…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  Sep 10, 2026
• Critical 9.1
  CVE-2026-49364

  Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

  An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  Sep 10, 2026
• High 7.5
  CVE-2026-49362

  Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

  An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Art…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  Sep 10, 2026
• Medium 6.5
  CVE-2026-59889

  jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrap…

  FasterXML jackson-databind druid thingsboard-tb-node Ubuntu Wolfi Maven
  Jul 14, 2026
• Medium 5.3
  CVE-2026-54515 Public exploit

  jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are appli…

  FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 23, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480638
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492016
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2500653
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67604.json
• report
  https://access.redhat.com/security/cve/CVE-2026-49362
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-49362
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-49362
• report
  https://access.redhat.com/security/cve/CVE-2026-49364
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478013
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-49364
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-49364
• report
  https://access.redhat.com/security/cve/CVE-2026-54515
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-54515
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-54515
• article
  https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa
• article
  https://github.com/FasterXML/jackson-databind/issues/5962
• article
  https://github.com/FasterXML/jackson-databind/issues/5964
• article
  https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v
• report
  https://access.redhat.com/security/cve/CVE-2026-57967
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-57967
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-57967
• report
  https://access.redhat.com/security/cve/CVE-2026-59889
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59889
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59889
• article
  https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b
• article
  https://github.com/FasterXML/jackson-databind/issues/6060
• article
  https://github.com/FasterXML/jackson-databind/pull/6056
• article
  https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh