Description
A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | wildfly | < 36.0.0 | 36.0.0 |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0.8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.33.0-3.redhat_00017.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-beanutils | 1.11.0-1.redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-apache-cxf +3 | 4.0.6-2.redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-apache-mime4j +2 | 0.8.12-1.redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 800.8.0-1.GA_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-elytron-web | 4.0.3-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-fastinfoset | 2.1.1-1.redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-hal-console | 3.6.24-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.2.36-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-httpcomponents-asyncclient | 4.1.5-4.redhat_00006.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-jboss-remoting | 5.0.31-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-jbossws-cxf | 7.3.3-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-narayana +8 | 6.0.6-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-neethi | 3.2.1-1.redhat_00002.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava2 | 2.2.21-3.redhat_00002.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-slf4j +1 | 2.0.17-1.redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-velocity +1 | 2.3.0-4.redhat_00010.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-wildfly +4 | 8.0.8-4.GA_redhat_00006.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-wildfly-elytron +1 | 2.2.11-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.16.0-21.redhat_00055.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.5.10-1.redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1:1.0.2-5.redhat_00004.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.9.6-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.14-9.SP10_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.27-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.23-3.SP2_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.21-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-42.Final_redhat_00042.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.15-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.23-3.GA_redhat_00002.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.26-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.23-3.GA_redhat_00002.1.el8eap | RHSA-2025:10926, RHSA-2025:10925 |
Advisories 6
- RHSA-2025:10926 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10925 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10924 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10453 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.8 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10452 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.8 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2025-0729 Red Hat JBoss Enterprise Application Platform und WildFly: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Dec 28, 2025
References
- RHSA-2025:10452 vendor-advisory
- RHSA-2025:10453 vendor-advisory
- RHSA-2025:10459 vendor-advisory
- RHSA-2025:10924 vendor-advisory
- RHSA-2025:10925 vendor-advisory
- RHSA-2025:10926 vendor-advisory
- RHSA-2025:10931 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-2251 vdb-entry
- RHBZ#2351678 issue-tracking
- https://github.com/wildfly/wildfly/pull/18872
- https://github.com/wildfly/wildfly/releases/tag/36.0.0.Final
- https://issues.redhat.com/browse/WFLY-20550