High WID-SEC-2026-0054 3 CVEs

Red Hat JBoss Enterprise Application Platform (Undertow): Mehrere Schwachstellen

Published Jan 8, 2026 · Updated Jun 29, 2026 · Revision 8 · de-DE

Vendor: IBM Vendor: NETAPP Vendor: Red Hat Product: ActiveIQ Unified Manager Product: Enterprise Linux Product: InfoSphere Information Server Product: JBoss Enterprise Application Platform Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Denial of Service Zustand herbeizuführen, Daten zu manipulieren und um weitere Angriffe wie Cache-Poisoning und Session-Hijacking durchzuführen.

Product

JBoss Enterprise Application Platform ist eine skalierbare Plattform für Java-Anwendungen, inklusive JBoss Application Server, JBoss Hibernate und Boss Seam.

Vulnerabilities 3

Critical 9.6

CVE-2025-12543

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malici…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Wolfi Maven

Jan 7, 2026
High 7.5

CVE-2024-3884

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will caus…

Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Wolfi Maven

Dec 3, 2025
High 7.5

CVE-2025-9784 Public exploit

Undertow: undertow madeyoureset http/2 ddos vulnerability

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeate…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Wolfi Maven

Sep 2, 2025

Revision history

2026-06-29 #8
Neue Updates von Red Hat aufgenommen
2026-03-29 #7
Neue Updates von Red Hat aufgenommen
2026-03-24 #6
Neue Updates von IBM aufgenommen
2026-03-18 #5
Neue Updates von Red Hat aufgenommen
2026-03-05 #4
Neue Updates von Red Hat aufgenommen
2026-02-01 #3
Neue Updates von NetApp aufgenommen
2026-01-13 #2
Zusammenfassung präzisiert
2026-01-08 #1
Initiale Fassung

References

RedHat Security Advisory vom 2026-01-08
https://access.redhat.com/errata/RHSA-2026:0383
RedHat Security Advisory vom 2026-01-08
https://access.redhat.com/errata/RHSA-2026:0384
RedHat Security Advisory vom 2026-01-08
https://access.redhat.com/errata/RHSA-2026:0386
RedHat Customer Portal vom 2026-01-08
https://access.redhat.com/security/cve/cve-2024-3884
RedHat Customer Portal vom 2026-01-08
https://access.redhat.com/security/cve/cve-2025-9784
RedHat Customer Portal vom 2026-01-08
https://access.redhat.com/security/cve/cve-2025-12543
NetApp Security Advisory NTAP-20260130-0004 vom 2026-01-30
https://security.netapp.com/advisory/NTAP-20260130-0004
Red Hat Security Advisory RHSA-2026:3891 vom 2026-03-05
https://access.redhat.com/errata/RHSA-2026:3891
Red Hat Security Advisory RHSA-2026:3892 vom 2026-03-05
https://access.redhat.com/errata/RHSA-2026:3892
Red Hat Security Advisory RHSA-2026:3890 vom 2026-03-05
https://access.redhat.com/errata/RHSA-2026:3890
Red Hat Security Advisory RHSA-2026:3889 vom 2026-03-05
https://access.redhat.com/errata/RHSA-2026:3889
Red Hat Security Advisory RHSA-2026:4924 vom 2026-03-18
https://access.redhat.com/errata/RHSA-2026:4924
Red Hat Security Advisory RHSA-2026:4916 vom 2026-03-18
https://access.redhat.com/errata/RHSA-2026:4916
Red Hat Security Advisory RHSA-2026:4915 vom 2026-03-18
https://access.redhat.com/errata/RHSA-2026:4915
Red Hat Security Advisory RHSA-2026:4917 vom 2026-03-18
https://access.redhat.com/errata/RHSA-2026:4917
IBM Security Bulletin 7266752 vom 2026-03-24
https://www.ibm.com/support/pages/node/7266752
Red Hat Security Advisory RHSA-2026:6011 vom 2026-03-30
https://access.redhat.com/errata/RHSA-2026:6011
Red Hat Security Advisory RHSA-2026:33371 vom 2026-06-30
https://access.redhat.com/errata/RHSA-2026:33371
Red Hat Security Advisory RHSA-2026:33372 vom 2026-06-30
https://access.redhat.com/errata/RHSA-2026:33372