Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.19 Update

Fixed packages 34

Vulnerabilities 7

• High 8.9
  CVE-2026-27727

  mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

  mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running appl…

  swaldman mchange-commons-java c3p0 com.mchange:mchange-commons-java Ubuntu Maven
  Feb 25, 2026
• High 8.9
  CVE-2026-27830

  c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

  c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` whi…

  swaldman c3p0 c3p0 com.mchange:c3p0 Debian Ubuntu Maven
  Feb 26, 2026
• High 7.5
  CVE-2026-42583

  Netty: Lz4FrameDecoder resource exhaustion

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus comp…

  netty io.netty netty netty-codec-compression Debian Wolfi Maven
  May 13, 2026
• High 7.3
  CVE-2026-42584

  Netty: HttpClientCodec response desynchronization

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines G…

  netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  May 13, 2026
• Medium 6.5
  CVE-2026-42585

  Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Fi…

  netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  May 13, 2026
• Medium 5.8
  CVE-2026-42581

  Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  May 13, 2026
• Low 2.9
  CVE-2026-42578

  Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  May 13, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html/7.3.0_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442671
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442908
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477219
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477224
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477226
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477227
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477232
• article
  https://issues.redhat.com/browse/JBEAP-34007
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73644.json
• report
  https://access.redhat.com/security/cve/CVE-2026-27727
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27727
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27727
• article
  https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44
• article
  https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal
• article
  https://www.mchange.com/projects/c3p0/#configuring_security
• article
  https://www.mchange.com/projects/c3p0/#security-note
• report
  https://access.redhat.com/security/cve/CVE-2026-27830
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27830
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27830
• article
  https://github.com/swaldman/c3p0/commit/e14cbd8166e423e2e9a9d6f08b2add3433492d6e
• article
  https://github.com/swaldman/c3p0/security/advisories/GHSA-5476-xc4j-rqcv
• report
  https://access.redhat.com/security/cve/CVE-2026-42578
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42578
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42578
• article
  https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr
• report
  https://access.redhat.com/security/cve/CVE-2026-42581
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42581
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42581
• article
  https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9
• report
  https://access.redhat.com/security/cve/CVE-2026-42583
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42583
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42583
• article
  https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6
• report
  https://access.redhat.com/security/cve/CVE-2026-42584
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42584