Description
This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.33.0-3.redhat_00017.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-beanutils | 1.11.0-1.redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-apache-cxf +3 | 4.0.6-2.redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-apache-mime4j +2 | 0.8.12-1.redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 800.8.0-1.GA_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-elytron-web | 4.0.3-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-fastinfoset | 2.1.1-1.redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-hal-console | 3.6.24-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.2.36-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-httpcomponents-asyncclient | 4.1.5-4.redhat_00006.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-jboss-remoting | 5.0.31-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-jbossws-cxf | 7.3.3-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-narayana +8 | 6.0.6-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-neethi | 3.2.1-1.redhat_00002.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava2 | 2.2.21-3.redhat_00002.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-slf4j +1 | 2.0.17-1.redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-velocity +1 | 2.3.0-4.redhat_00010.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-wildfly +4 | 8.0.8-4.GA_redhat_00006.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 8 | eap8-wildfly-elytron +1 | 2.2.11-1.Final_redhat_00001.1.el8eap | RHSA-2025:10453, RHSA-2025:10452 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.16.0-21.redhat_00055.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.5.10-1.redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1:1.0.2-5.redhat_00004.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.9.6-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.14-9.SP10_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.27-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.23-3.SP2_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.21-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-42.Final_redhat_00042.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.15-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.23-3.GA_redhat_00002.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.26-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.23-3.GA_redhat_00002.1.el8eap | RHSA-2025:10926, RHSA-2025:10925 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.hal:hal-console | < 3.7.11.Final | 3.7.11.Final | GHSA-f7jh-m6wp-jm7f |
Advisories 6
- RHSA-2025:10926 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10925 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10924 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10453 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.8 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10452 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.8 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2025-0650 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Jul 14, 2025