Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

Fixed packages 107

Vulnerabilities 35

• Critical 9.8
  CVE-2026-57967 Public exploit

  Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

  An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache Activ…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  Sep 10, 2026
• Critical 9.1
  CVE-2026-49364

  Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

  An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  Sep 10, 2026
• High 8.8
  CVE-2026-15555

  Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

  A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8
  Aug 11, 2026
• High 8.8
  CVE-2026-86404

  Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default

  EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by defau…

  Red Hat Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat build of Apache Camel for Spring Boot 4
  Sep 7, 2026
• High 8.7
  CVE-2026-3505

  Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

  Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.…

  Legion of the Bouncy Castle BC-JAVA apache-nifi bouncycastle Debian Ubuntu Wolfi Maven
  Apr 15, 2026
• High 8.7
  CVE-2026-56745

  Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

  Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteB…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jul 21, 2026
• High 8.7
  CVE-2026-59649

  OpenPGP user-attribute subpacket length bounded only by JVM max memory

  In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), …

  Legion of the Bouncy Castle BC-JAVA BC-LTS-JAVA BC-FJA Debian Ubuntu
  Aug 3, 2026
• High 8.7
  CVE-2026-68494

  jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

  The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into …

  FasterXML jackson-core druid trino Ubuntu Wolfi Maven
  Aug 4, 2026
• High 8.1
  CVE-2026-15560

  Openjdk-orb: unauthed class loading via iiop in eap

  when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 8.1 Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
  Aug 11, 2026
• High 8.1
  CVE-2026-50632

  Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

  A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. User…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-transports-jms Maven
  Jun 12, 2026
• High 8.1
  CVE-2026-54512 Public exploit

  jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…

  FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 23, 2026
• High 8.1
  CVE-2026-54513

  jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only…

  FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 23, 2026
• High 7.5
  CVE-2026-15561

  Undertow-core: oom via missing limits in chunked trailer in eap's undertow

  A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achievi…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Debian Ubuntu
  Aug 11, 2026
• High 7.5
  CVE-2026-15562

  Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service

  A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
  Aug 11, 2026
• High 7.5
  CVE-2026-15565

  Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method

  A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu
  Aug 11, 2026
• High 7.5
  CVE-2026-15567

  Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

  A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7
  Aug 11, 2026
• High 7.5
  CVE-2026-44417

  Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

  The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are re…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-transports-jms Maven
  May 22, 2026
• High 7.5
  CVE-2026-46581

  In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or…

  Eclipse Foundation Eclipse Mojarra
  Aug 5, 2026
• High 7.5
  CVE-2026-49362

  Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

  An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Art…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  Sep 10, 2026
• High 7.5
  CVE-2026-49363

  Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

  An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: fro…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  Sep 10, 2026
• High 7.5
  CVE-2026-55831

  Netty SPDY SETTINGS frame count materializes unbounded settings map

  Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes …

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jul 20, 2026
• High 7.5
  CVE-2026-55833

  Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

  Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeader…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jul 20, 2026
• High 7.5
  CVE-2026-5680

  Undertow-core: undertow: denial of service via websocket permessage-deflate processing

  A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuf…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu
  Aug 27, 2026
• High 7.5
  CVE-2026-62243

  Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

  Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based tru…

  netty netty netty netty Debian Ubuntu
  Aug 22, 2026
• High 7.4
  CVE-2026-15554

  Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery

  the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a fo…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Debian Ubuntu
  Aug 11, 2026
• High 7.4
  CVE-2026-15563

  Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos

  A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat Fuse 7
  Aug 11, 2026
• Medium 6.9
  CVE-2026-59899

  Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` …

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jul 29, 2026
• Medium 6.5
  CVE-2026-49875

  Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

  Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 o…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven
  Jun 12, 2026
• Medium 6.5
  CVE-2026-56746

  Netty has a Security Control Bypass via CORS Short-Circuit Failure

  Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHand…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jul 21, 2026
• Medium 6.5
  CVE-2026-59889

  jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrap…

  FasterXML jackson-databind druid thingsboard-tb-node Ubuntu Wolfi Maven
  Jul 14, 2026
• Medium 5.9
  CVE-2026-10832

  Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

  A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive me…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8
  Sep 18, 2026
• Medium 5.3
  CVE-2026-14180

  Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

  A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size a…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu
  Aug 11, 2026
• Medium 5.3
  CVE-2026-54515 Public exploit

  jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are appli…

  FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 23, 2026
• Medium 5.3
  CVE-2026-73508

  Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

  Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsC…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Aug 13, 2026
• Medium 4.2
  CVE-2026-85511

  Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

  A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8
  Sep 18, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index
• article
  https://access.redhat.com/articles/7137769
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2455350
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458638
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477930
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478013
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480637
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480638
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480729
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483131
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483133
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483135
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483136
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483138
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483140
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484703
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488304
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488309
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2490628
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491620
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492010
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492015
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492016
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492627
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494771
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2500653
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503103
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2505422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2505911
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507482
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510195
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2511026
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515377
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2521309