WID-SEC-2026-2227 — Red Hat JBoss Enterprise Application Platform (io.undertow.jastow): Schwachstelle ermöglicht Cross-Site Scripting

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

JBoss Enterprise Application Platform ist eine skalierbare Plattform für Java-Anwendungen, inklusive JBoss Application Server, JBoss Hibernate und Boss Seam.

Vulnerabilities 1

Medium 6.5

CVE-2025-12799

Jastow: jastow cross-site scripting attack due to unsanitized uri

A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.

Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Red Hat JBoss Enterprise Application Platform 8.1.7.GA

Jul 7, 2026

Revision history

2026-07-07 #1
Initiale Fassung

References

Red Hat Security Advisory RHSA-2026:36342 vom 2026-07-07
https://access.redhat.com/errata/RHSA-2026:36342
Red Hat Security Advisory RHSA-2026:36343 vom 2026-07-07
https://access.redhat.com/errata/RHSA-2026:36343
Red Hat Security Advisory RHSA-2026:36345 vom 2026-07-07
https://access.redhat.com/errata/RHSA-2026:36345