Skip to content
OpenAdvisories
Critical RHSA-2026:92057 5 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 37

ReleasePackageFixed in
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-apache-cxf 0:4.1.8-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-apache-cxf-rt 0:4.1.8-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-apache-cxf-services 0:4.1.8-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-apache-cxf-tools 0:4.1.8-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-apache-sshd 0:2.19.0-1.redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-buffer 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-codec 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-codec-dns 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-codec-http 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-codec-socks 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-common 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-handler 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-handler-proxy 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-resolver 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-resolver-dns 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-transport 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-transport-classes-epoll 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-transport-native-epoll 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-transport-native-epoll-debuginfo 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-netty-transport-native-unix-common 0:4.1.138-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-atom-provider 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-cdi 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-client 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-client-api 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-core 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-core-spi 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-crypto 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-jackson2-provider 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-jaxb-provider 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-jsapi 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-json-binding-provider 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-json-p-provider 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-multipart-provider 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-rxjava2 0:6.2.19-1.Final_redhat_00002.1.el8eap
Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.1::el8 eap8-resteasy-validator-provider 0:6.2.19-1.Final_redhat_00002.1.el8eap

Vulnerabilities 5

  • Critical 9.1
    CVE-2026-65583

    Apache CXF: Self-issued ID token claims validation skipped

    Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued …

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-57819

    Apache CXF: No default restriction on the amount of form parameters per message

    Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large …

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-64958

    Apache CXF: Denial of service via message header attachments

    An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this i…

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-65432

    Apache CXF: XXE via WSDL/XSD import parsing

    Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declar…

    Apache Software Foundation Apache CXF
  • Medium 6.5
    CVE-2026-59903 Public exploit

    Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

    Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index
  • article
    https://access.redhat.com/articles/7137769
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511978
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511979
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511981
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511995
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517538
  • article
    https://issues.redhat.com/browse/JBEAP-34959
  • article
    https://issues.redhat.com/browse/JBEAP-35632
  • article
    https://issues.redhat.com/browse/JBEAP-35651
  • article
    https://issues.redhat.com/browse/JBEAP-35658
  • article
    https://issues.redhat.com/browse/JBEAP-35795
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92057.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-57819
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-57819
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-57819
  • article
    https://lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289mov
  • report
    https://access.redhat.com/security/cve/CVE-2026-59903
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59903
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59903
  • article
    https://github.com/netty/netty/pull/17213
  • article
    https://github.com/netty/netty/pull/17217
  • article
    https://github.com/netty/netty/releases/tag/netty-4.1.137.Final
  • article
    https://github.com/netty/netty/releases/tag/netty-4.2.17.Final
  • article
    https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46
  • report
    https://access.redhat.com/security/cve/CVE-2026-64958
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64958
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64958
  • article
    https://lists.apache.org/thread/trsnkxc2f21585zlt819blvchgl6oykb
  • report
    https://access.redhat.com/security/cve/CVE-2026-65432
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65432
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65432
  • article
    https://lists.apache.org/thread/5qs207krzg51jl3zs3cvnl5lt9njp8c3
  • report
    https://access.redhat.com/security/cve/CVE-2026-65583
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65583
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65583
  • article
    https://lists.apache.org/thread/fzj8yzgfl53gclxrcdrnrx3grcpkq51j